Product by Elastic
Elasticsearch
93 known vulnerabilities in Elasticsearch (Elastic), 2 of them actively exploited (CISA KEV).
Key figures
93
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2015-1427 | Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability In CISA KEValso in 1 other product | 9.8 | |
| Critical | CVE-2014-3120 | Elasticsearch Remote Code Execution Vulnerability In CISA KEV | 8.1 | |
| Critical | CVE-2015-5377 | Elasticsearch: Code Execution | 9.8 | |
| High | CVE-2021-22146 | Elasticsearch: security vulnerability | 7.5 | |
| High | CVE-2023-31419 | Elasticsearch StackOverflow vulnerability | 6.5 | |
| Medium | CVE-2021-22145 | Elasticsearch: Exposure of Sensitive Information to an Unauthorized Actor | 6.5 | |
| High | CVE-2022-23712 | Elasticsearch: Improper Check for Unusual or Exceptional Conditions | 7.5 | |
| High | CVE-2026-72649 | Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution | 8.8 | |
| High | CVE-2018-3831 | Elasticsearch: Exposure of Sensitive Information to an Unauthorized Actor | 8.8 | |
| High | CVE-2020-7009 | Elasticsearch: Incorrect Privilege Assignment | 8.8 | |
| High | CVE-2019-7611 | Elasticsearch: Improper Access Control | 8.1 | |
| High | CVE-2023-31418 | Elasticsearch uncontrolled resource consumption | 7.5 | |
| High | CVE-2020-7014 | Elasticsearch: Incorrect Privilege Assignment | 8.8 | |
| Medium | CVE-2021-22144 | Elasticsearch: Denial of Service | 6.5 | |
| High | CVE-2026-72642 | Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process | 8.8 | |
| Medium | CVE-2019-7619 | Elasticsearch: Exposure of Sensitive Information to an Unauthorized Actor | 5.3 | |
| Medium | CVE-2018-17244 | Elasticsearch: Race Condition | 6.5 | |
| Medium | CVE-2020-7019 | Elasticsearch: Privilege Context Switching Error | 6.5 | |
| Medium | CVE-2026-72683 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | 6.5 | |
| Medium | CVE-2026-72686 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | 6.5 | |
| High | CVE-2018-3827 | Elasticsearch: Insertion of Sensitive Information into Log File | 8.1 | |
| Medium | CVE-2026-103006 | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service | 6.5 | |
| High | CVE-2026-103007 | Incorrect Authorization in Elasticsearch Leading to Privilege Escalation | 7.2 | |
| Medium | CVE-2018-17247 | Elasticsearch: Improper Restriction of XML External Entity Reference | 5.9 | |
| Medium | CVE-2026-72678 | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service | 6.5 |