← Back

Elastic

elastic

363 CVEs • 32 products

Products (32)

Click to collapse
Toggle
Kibana
kibana
189 CVEs
Elasticsearch
elasticsearch
91 CVEs
Logstash
logstash
13 CVEs
X Pack
x-pack
9 CVEs
Elastic Cloud Enterprise
elastic_cloud_enterprise
9 CVEs
Elastic Cloud On Kubernetes
elastic_cloud_on_kubernetes
6 CVEs
Endpoint Security
endpoint_security
6 CVEs
Elastic Agent
elastic_agent
6 CVEs
Enterprise Search
enterprise_search
5 CVEs
Fleet Server
fleet_server
4 CVEs
Apm Server
apm_server
4 CVEs
Apm Agent
apm_agent
3 CVEs
Filebeat
filebeat
3 CVEs
Elasticsearch X Pack
elasticsearch_x-pack
2 CVEs
Kibana X Pack
kibana_x-pack
2 CVEs
Logstash X Pack
logstash_x-pack
2 CVEs
Winlogbeat
winlogbeat
2 CVEs
Elastic App Search
elastic_app_search
2 CVEs
Endgame
endgame
2 CVEs
Elastic Beats
elastic_beats
2 CVEs
Kibana Reporting
kibana_reporting
1 CVE
Azure Repository
azure_repository
1 CVE
Apm Agent Ruby
apm-agent-ruby
1 CVE
Endpoint
endpoint
1 CVE
Elastic Fleet Server
elastic_fleet_server
1 CVE
Elastic Sharepoint Online Python Connector
elastic_sharepoint_online_python_connector
1 CVE
Apm .net Agent
apm_.net_agent
1 CVE
Apm Java Agent
apm_java_agent
1 CVE
Network Drive Connector
network_drive_connector
1 CVE
Elastic Package Registry
elastic_package_registry
1 CVE
Metricbeat
metricbeat
1 CVE
Maps Server
maps_server
1 CVE

CVEs (363)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2015-1427
2Elastic
Redhat
2Elasticsearch
Fuse
Apr 22, 2026
Feb 17, 2015
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
CVE-2014-3120
2Elastic
Elasticsearch
2Elasticsearch
Elasticsearch
Apr 22, 2026
Jul 28, 2014
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only vio...Show more
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.Show less
CVE-2014-4326
1Elastic
1Logstash
May 6, 2026
Jul 22, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.