| CVE-2026-33458 |
Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure
|
6.8
Moyenne
|
8 avr. 2026 |
| CVE-2026-33459 |
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)
|
6.5
Moyenne
|
8 avr. 2026 |
| CVE-2026-33460 |
Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via Privilege Abuse…
|
4.3
Moyenne
|
8 avr. 2026 |
| CVE-2026-33461 |
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122)
|
7.7
Élevée
|
8 avr. 2026 |
| CVE-2026-4498 |
Execution with Unnecessary Privileges (CWE-250) in Kibana’s Fleet plugin debug route handlers can lead reading index…
|
7.7
Élevée
|
8 avr. 2026 |
| CVE-2026-26940 |
Improper Validation of Specified Quantity in Input (CWE-1284) in the Timelion visualization plugin in Kibana can lead…
|
6.5
Moyenne
|
19 mars 2026 |
| CVE-2026-26939 |
Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint…
|
6.5
Moyenne
|
19 mars 2026 |
| CVE-2026-26938 |
Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) exists in Workflows in Kibana which…
|
8.6
Élevée
|
26 févr. 2026 |
| CVE-2026-26937 |
Uncontrolled Resource Consumption (CWE-400) in the Timelion component in Kibana can lead Denial of Service via Input…
|
6.5
Moyenne
|
26 févr. 2026 |
| CVE-2026-26936 |
Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead…
|
4.9
Moyenne
|
26 févr. 2026 |
| CVE-2026-26935 |
Improper Input Validation (CWE-20) in the internal Content Connectors search endpoint in Kibana can lead Denial of…
|
6.5
Moyenne
|
26 févr. 2026 |
| CVE-2026-26934 |
Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with…
|
6.5
Moyenne
|
26 févr. 2026 |
| CVE-2026-0532 |
External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker…
|
8.6
Élevée
|
14 janv. 2026 |
| CVE-2026-0543 |
Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation…
|
6.5
Moyenne
|
13 janv. 2026 |
| CVE-2026-0531 |
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation…
|
6.5
Moyenne
|
13 janv. 2026 |
| CVE-2026-0530 |
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation…
|
6.5
Moyenne
|
13 janv. 2026 |
| CVE-2025-68422 |
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated…
|
4.3
Moyenne
|
18 déc. 2025 |
| CVE-2025-68386 |
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated…
|
4.3
Moyenne
|
18 déc. 2025 |
| CVE-2025-68389 |
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user…
|
6.5
Moyenne
|
18 déc. 2025 |
| CVE-2025-68387 |
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an…
|
6.1
Moyenne
|
18 déc. 2025 |
| CVE-2025-68385 |
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated…
|
7.2
Élevée
|
18 déc. 2025 |
| CVE-2025-37732 |
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated…
|
5.4
Moyenne
|
15 déc. 2025 |
| CVE-2025-37734 |
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by…
|
4.3
Moyenne
|
12 nov. 2025 |
| CVE-2025-37735 |
Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system…
|
7.0
Élevée
|
6 nov. 2025 |
| CVE-2025-25017 |
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)
|
8.2
Élevée
|
10 oct. 2025 |