Product by Elastic

    Elastic Kibana

    205 known vulnerabilities in Elastic Kibana (Elastic), 1 of them actively exploited (CISA KEV).

    Key figures

    205

    Vulnerabilities

    1

    Actively exploited (KEV)

    0

    Used by ransomware

    13

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Elastic Kibana (Elastic)
    CriticalCVE-2019-7609

    Kibana Arbitrary Code Execution

    In CISA KEValso in 1 other product

    		10.0
    CriticalCVE-2025-25014

    Kibana arbitrary code execution via prototype pollution

    		9.1
    CriticalCVE-2018-17246

    Elastic Kibana: External Control of File Name or Path

    also in 1 other product

    		9.8
    HighCVE-2020-7012

    Elastic Kibana: Code Injection

    		8.8
    CriticalCVE-2019-7610

    Elastic Kibana: Code Injection

    		9.0
    CriticalCVE-2024-37287

    Kibana arbitrary code execution via prototype pollution

    		9.1
    CriticalCVE-2025-25015

    Kibana arbitrary code execution via prototype pollution

    		9.9
    CriticalCVE-2018-17245

    Elastic Kibana: Insertion of Sensitive Information Into Sent Data

    		9.8
    CriticalCVE-2024-37285

    Kibana arbitrary code execution via YAML deserialization

    		9.1
    HighCVE-2016-1000219

    Elastic Kibana: security vulnerability

    		7.5
    HighCVE-2020-7013

    Elastic Kibana: Code Injection

    also in 1 other product

    		7.2
    CriticalCVE-2024-37288

    Elastic Kibana: Deserialization of Untrusted Data

    		9.9
    HighCVE-2026-63137

    Incorrect Authorization in Kibana Leading to Privilege Escalation

    also in 1 other product

    		8.3
    MediumCVE-2019-7616

    Elastic Kibana: Server-Side Request Forgery (SSRF)

    		4.9
    HighCVE-2026-102406

    Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

    also in 1 other product

    		8.8
    HighCVE-2017-8452

    Elastic Kibana: Missing Release of File Descriptor or Handle after Effective Lifetime

    		7.5
    MediumCVE-2024-23443

    Elastic Kibana: Uncontrolled Resource Consumption

    		4.9
    MediumCVE-2018-3830

    Elastic Kibana: Cross-site Scripting

    also in 1 other product

    		6.1
    CriticalCVE-2023-31415

    Elastic Kibana: Code Injection

    		8.8
    HighCVE-2026-72665

    Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions

    also in 1 other product

    		8.1
    MediumCVE-2019-7618

    Elastic Code: Insertion of Sensitive Information into Externally-Accessible File or Directory

    		6.5
    HighCVE-2026-72670

    Elastic Kibana: Exposure of Sensitive Information to an Unauthorized Actor

    also in 1 other product

    		7.7
    HighCVE-2026-82302

    Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

    also in 1 other product

    		8.1
    HighCVE-2026-78583

    Incorrect Authorization in Kibana Leading to Privilege Escalation

    also in 1 other product

    		8.1
    CriticalCVE-2023-31422

    Kibana Insertion of Sensitive Information into Log File

    		9.0

    All vulnerabilities in search

    All products by Elastic