← Back

Kibana

kibana

Vendor: Elastic • 185 CVEs

CVEs (185)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Elastic
1Kibana
Jun 17, 2026
Dec 18, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site s...Show more
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.Show less
1Elastic
1Kibana
Jun 17, 2026
Dec 18, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so,...Show more
Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even though they do not have permission to do so, making it visible to everyone in the space via a crafted a HTTP request.Show less
1Elastic
1Kibana
Jun 17, 2026
Dec 18, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scr...Show more
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.Show less
1Elastic
1Kibana
Jun 17, 2026
Dec 15, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. Thi...Show more
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.Show less
1Elastic
1Kibana
Jun 17, 2026
Nov 12, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
1Elastic
1Kibana
Jun 17, 2026
Oct 10, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)
1Elastic
1Kibana
Jun 17, 2026
Oct 10, 2025
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)
1Elastic
1Kibana
Jun 17, 2026
Oct 7, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.
1Elastic
1Kibana
Jun 17, 2026
Aug 28, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
1Elastic
1Kibana
Jun 17, 2026
Jun 25, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a specially crafted URL.
1Elastic
1Kibana
Jun 17, 2026
Jun 10, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint.
1Elastic
1Kibana
Jun 17, 2026
May 6, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
1Elastic
1Kibana
Jun 17, 2026
May 1, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Unrestricted file upload in Kibana allows an authenticated attacker to compromise software integrity by uploading a crafted malicious file due to insufficient server-side validation.
1Elastic
1Kibana
Jun 17, 2026
May 1, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics a...Show more
Unrestricted upload of a file with dangerous type in Kibana can lead to arbitrary JavaScript execution in a victim’s browser (XSS) via crafted HTML and JavaScript files. The attacker must have access to the Synthetics app AND/OR have access to write to the synthetics indices.Show less
1Elastic
1Kibana
Jun 17, 2026
Apr 8, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal.
1Elastic
1Kibana
Jun 17, 2026
Apr 8, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observabilit...Show more
An issue has been identified where a specially crafted request sent to an Observability API could cause the kibana server to crash. A successful attack requires a malicious user to have read permissions for Observability assigned to them.Show less
1Elastic
1Kibana
Jun 17, 2026
Mar 5, 2025
N/A· v4
9.9 CRITICAL· v3
N/A· v2
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer ro...Show more
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kibana versions >= 8.15.0 and < 8.17.1, this is exploitable by users with the Viewer role. In Kibana versions 8.17.1 and 8.17.2 , this is only exploitable by users that have roles that contain all the following privileges: fleet-all, integrations-all, actions:execute-advanced-connectorsShow less
1Elastic
1Kibana
Jun 17, 2026
Jan 23, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any fea...Show more
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana.Show less
1Elastic
1Kibana
Jun 17, 2026
Jan 23, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability...Show more
An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/metrics/snapshot. This can be carried out by users with read access to the Observability Metrics or Logs features in Kibana.Show less
1Elastic
1Kibana
Jun 17, 2026
Jan 23, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints...Show more
A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used to send requests to internal endpoints. Due to the nature of the underlying request, only endpoints available over https that return JSON could be accessed. This can be carried out by users with read access to Fleet.Show less