# Elastic Kibana. Every CVE that names Elastic Kibana among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-115295.md) `CVE-2026-115295` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control - [Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion](https://agentprime.io/advisories/CVE-2026-115294.md) `CVE-2026-115294` · CVE record: Elastic Kibana · CVSS 7.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal - [Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure](https://agentprime.io/advisories/CVE-2026-115293.md) `CVE-2026-115293` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-115292.md) `CVE-2026-115292` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure](https://agentprime.io/advisories/CVE-2026-102412.md) `CVE-2026-102412` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-102410.md) `CVE-2026-102410` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception](https://agentprime.io/advisories/CVE-2026-102406.md) `CVE-2026-102406` · CVE record: Elastic Kibana · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control - [Uncontrolled Resource Consumption in Kibana Leading to denial of service](https://agentprime.io/advisories/CVE-2026-94400.md) `CVE-2026-94400` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Denial of service - [Missing Authorization in Kibana Leading to Unauthorized Deletion of Data](https://agentprime.io/advisories/CVE-2026-78582.md) `CVE-2026-78582` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data](https://agentprime.io/advisories/CVE-2026-72662.md) `CVE-2026-72662` · CVE record: Elastic Kibana · CVSS 6.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control - [Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-72668.md) `CVE-2026-72668` · CVE record: Elastic Kibana · CVSS 7.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-441 - [Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification](https://agentprime.io/advisories/CVE-2026-82302.md) `CVE-2026-82302` · CVE record: Elastic Kibana · CVSS 8.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-82299.md) `CVE-2026-82299` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-82298.md) `CVE-2026-82298` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations](https://agentprime.io/advisories/CVE-2026-78596.md) `CVE-2026-78596` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control - [Missing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure](https://agentprime.io/advisories/CVE-2026-78595.md) `CVE-2026-78595` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control - [Improper Control of Generation of Code in Kibana Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-78593.md) `CVE-2026-78593` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection - [Incorrect Authorization in Kibana Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-78583.md) `CVE-2026-78583` · CVE record: Elastic Kibana · CVSS 8.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Leading to Unauthorized Resource Consumption](https://agentprime.io/advisories/CVE-2026-82293.md) `CVE-2026-82293` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-78586.md) `CVE-2026-78586` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Denial of service - [Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure](https://agentprime.io/advisories/CVE-2026-78584.md) `CVE-2026-78584` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-204 - [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion](https://agentprime.io/advisories/CVE-2026-78591.md) `CVE-2026-78591` · CVE record: Elastic Kibana · CVSS 6.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal - [Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources](https://agentprime.io/advisories/CVE-2026-78590.md) `CVE-2026-78590` · CVE record: Elastic Kibana · CVSS 7.3 High · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal - [Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources](https://agentprime.io/advisories/CVE-2026-78599.md) `CVE-2026-78599` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal - [Incorrect Authorization in Kibana Leading to Unauthorized Cross-Space Exposure of Machine Learning Job Data](https://agentprime.io/advisories/CVE-2026-78598.md) `CVE-2026-78598` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure](https://agentprime.io/advisories/CVE-2026-78601.md) `CVE-2026-78601` · CVE record: Elastic Kibana · CVSS 5.5 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control - [Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-63138.md) `CVE-2026-63138` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection - [Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation](https://agentprime.io/advisories/CVE-2026-78597.md) `CVE-2026-78597` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources](https://agentprime.io/advisories/CVE-2026-78592.md) `CVE-2026-78592` · CVE record: Elastic Kibana · CVSS 7.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: Path traversal - [Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data](https://agentprime.io/advisories/CVE-2026-78606.md) `CVE-2026-78606` · CVE record: Elastic Kibana · CVSS 4.2 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata](https://agentprime.io/advisories/CVE-2026-78603.md) `CVE-2026-78603` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-78608.md) `CVE-2026-78608` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-72654.md) `CVE-2026-72654` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Privilege escalation - [Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring](https://agentprime.io/advisories/CVE-2026-72633.md) `CVE-2026-72633` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data](https://agentprime.io/advisories/CVE-2026-72641.md) `CVE-2026-72641` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72628.md) `CVE-2026-72628` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-409 - [Uncaught Exception in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72644.md) `CVE-2026-72644` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-248 - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72682.md) `CVE-2026-72682` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Incorrect Authorization in Kibana Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-63137.md) `CVE-2026-63137` · CVE record: Elastic Kibana · CVSS 8.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72652.md) `CVE-2026-72652` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-33465.md) `CVE-2026-33465` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana](https://agentprime.io/advisories/CVE-2026-78581.md) `CVE-2026-78581` · CVE record: Elastic Kibana · CVSS 4.2 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control - [Uncaught Exception in Kibana Cases Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-49096.md) `CVE-2026-49096` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-248 - [Observable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys](https://agentprime.io/advisories/CVE-2026-72632.md) `CVE-2026-72632` · CVE record: Elastic Kibana · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Information disclosure - [Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys](https://agentprime.io/advisories/CVE-2026-72631.md) `CVE-2026-72631` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation - [Incorrect Authorization in Kibana Fleet Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-72630.md) `CVE-2026-72630` · CVE record: Elastic Kibana · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Space Access to Machine Learning Trained Models](https://agentprime.io/advisories/CVE-2026-72629.md) `CVE-2026-72629` · CVE record: Elastic Kibana · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents](https://agentprime.io/advisories/CVE-2026-72643.md) `CVE-2026-72643` · CVE record: Elastic Kibana · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification](https://agentprime.io/advisories/CVE-2026-72655.md) `CVE-2026-72655` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72653.md) `CVE-2026-72653` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72651.md) `CVE-2026-72651` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-72650.md) `CVE-2026-72650` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72663.md) `CVE-2026-72663` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Missing Authorization in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-72661.md) `CVE-2026-72661` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Uncaught Exception in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72660.md) `CVE-2026-72660` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-248 - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72659.md) `CVE-2026-72659` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Cross-Site Request Forgery in Kibana Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-72658.md) `CVE-2026-72658` · CVE record: Elastic Kibana · CVSS 7.3 High · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site request forgery (CSRF) - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72667.md) `CVE-2026-72667` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts](https://agentprime.io/advisories/CVE-2026-72666.md) `CVE-2026-72666` · CVE record: Elastic Kibana · CVSS 6.8 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions](https://agentprime.io/advisories/CVE-2026-72665.md) `CVE-2026-72665` · CVE record: Elastic Kibana · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .