# Elastic Kibana. Every CVE that names Elastic Kibana among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://agentprime.io/advisories/CVE-2025-68385.md) `CVE-2025-68385` · CVE record: Elastic Kibana · CVSS 7.2 High · Not analysed yet · Published 18 Dec 2025 · Tags: Cross-site scripting (XSS) - [Kibana Cross-site Scripting via the Integration Package Upload Functionality](https://agentprime.io/advisories/CVE-2025-37732.md) `CVE-2025-37732` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Cross-site scripting (XSS) - [Kibana Origin Validation Error](https://agentprime.io/advisories/CVE-2025-37734.md) `CVE-2025-37734` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: CWE-346 - [Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM.](https://agentprime.io/advisories/CVE-2025-37735.md) `CVE-2025-37735` · CVE record: Elastic Kibana · CVSS 7.0 High · Not analysed yet · Published 6 Nov 2025 · Tags: CWE-281 - [Kibana Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2025-25017.md) `CVE-2025-25017` · CVE record: Elastic Kibana · CVSS 8.2 High · Not analysed yet · Published 10 Oct 2025 · Tags: Cross-site scripting (XSS) - [Kibana Stored Cross-Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2025-25018.md) `CVE-2025-25018` · CVE record: Elastic Kibana · CVSS 8.7 High · Not analysed yet · Published 10 Oct 2025 · Tags: Cross-site scripting (XSS) - [Kibana Cross-Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2025-25009.md) `CVE-2025-25009` · CVE record: Elastic Kibana · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2025 · Tags: Cross-site scripting (XSS) - [Kibana Insufficiently Protected Credentials in the CrowdStrike Connector](https://agentprime.io/advisories/CVE-2025-37728.md) `CVE-2025-37728` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: Hard-coded credentials - [Kibana privilege escalation via reporting_user role](https://agentprime.io/advisories/CVE-2025-25010.md) `CVE-2025-25010` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: Broken access control - [Kibana Open Redirect](https://agentprime.io/advisories/CVE-2025-25012.md) `CVE-2025-25012` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Open redirect - [Kibana Improper Authorization](https://agentprime.io/advisories/CVE-2024-43706.md) `CVE-2024-43706` · CVE record: Elastic Kibana · CVSS 7.6 High · Not analysed yet · Published 10 Jun 2025 · Tags: Broken access control - [Kibana arbitrary code execution via prototype pollution](https://agentprime.io/advisories/CVE-2025-25014.md) `CVE-2025-25014` · CVE record: Elastic Kibana · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 6 May 2025 · Tags: Prototype pollution - [Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS](https://agentprime.io/advisories/CVE-2024-11390.md) `CVE-2024-11390` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 1 May 2025 · Tags: Unrestricted file upload - [Kibana Unrestricted Upload of File](https://agentprime.io/advisories/CVE-2025-25016.md) `CVE-2025-25016` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 1 May 2025 · Tags: Unrestricted file upload - [Kibana Prototype Pollution can lead to code injection](https://agentprime.io/advisories/CVE-2024-12556.md) `CVE-2024-12556` · CVE record: Elastic Kibana · CVSS 8.7 High · Not analysed yet · Published 8 Apr 2025 · Tags: Prototype pollution - [Uncontrolled resource consumption in Elastic Kibana](https://agentprime.io/advisories/CVE-2024-52974.md) `CVE-2024-52974` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: Denial of service - [Kibana arbitrary code execution via prototype pollution](https://agentprime.io/advisories/CVE-2025-25015.md) `CVE-2025-25015` · CVE record: Elastic Kibana · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: Prototype pollution - [Resource allocation without limits in Elastic Kibana](https://agentprime.io/advisories/CVE-2024-43708.md) `CVE-2024-43708` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: Denial of service - [Kibana allocation of resources without limits or throttling leads to crash](https://agentprime.io/advisories/CVE-2024-52972.md) `CVE-2024-52972` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: Denial of service - [Kibana exposure of sensitive information to an unauthorized actor](https://agentprime.io/advisories/CVE-2024-43707.md) `CVE-2024-43707` · CVE record: Elastic Kibana · CVSS 7.7 High · Not analysed yet · Published 23 Jan 2025 · Tags: Information disclosure - [Kibana server-side request forgery](https://agentprime.io/advisories/CVE-2024-43710.md) `CVE-2024-43710` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: Server-side request forgery (SSRF) - [Kibana allocation of resources without limits or throttling leads to crash](https://agentprime.io/advisories/CVE-2024-52973.md) `CVE-2024-52973` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jan 2025 · Tags: Denial of service - [Kibana arbitrary code execution via YAML deserialization](https://agentprime.io/advisories/CVE-2024-37285.md) `CVE-2024-37285` · CVE record: Elastic Kibana · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Nov 2024 · Tags: Insecure deserialization - [Deserialization of untrusted data in Elastic Kibana](https://agentprime.io/advisories/CVE-2024-37288.md) `CVE-2024-37288` · CVE record: Elastic Kibana · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2024 · Tags: Insecure deserialization - [Kibana arbitrary code execution via prototype pollution](https://agentprime.io/advisories/CVE-2024-37287.md) `CVE-2024-37287` · CVE record: Elastic Kibana · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2024 · Tags: Code injection - [Kibana Denial of Service issue](https://agentprime.io/advisories/CVE-2024-37281.md) `CVE-2024-37281` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2024 · Tags: Denial of service - [Uncontrolled resource consumption in Elastic Kibana](https://agentprime.io/advisories/CVE-2024-23443.md) `CVE-2024-23443` · CVE record: Elastic Kibana · CVSS 4.9 Medium · Not analysed yet · Published 19 Jun 2024 · Tags: Denial of service - [Kibana open redirect issue](https://agentprime.io/advisories/CVE-2024-23442.md) `CVE-2024-23442` · CVE record: Elastic Kibana · CVSS 6.1 Medium · Not analysed yet · Published 14 Jun 2024 · Tags: Open redirect - [Kibana Broken Access Control issue](https://agentprime.io/advisories/CVE-2024-37279.md) `CVE-2024-37279` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 13 Jun 2024 · Tags: Broken access control - [Kibana Broken Access Control issue](https://agentprime.io/advisories/CVE-2024-23446.md) `CVE-2024-23446` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2024 · Tags: Broken access control - [Kibana Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2023-46675.md) `CVE-2023-46675` · CVE record: Elastic Kibana · CVSS 8.0 High · Not analysed yet · Published 13 Dec 2023 · Tags: Information disclosure - [Kibana Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2023-46671.md) `CVE-2023-46671` · CVE record: Elastic Kibana · CVSS 8.0 High · Not analysed yet · Published 13 Dec 2023 · Tags: Information disclosure - [Kibana Reporting vulnerabilities](https://agentprime.io/advisories/CVE-2021-22142.md) `CVE-2021-22142` · CVE record: Elastic Kibana · CVSS 6.6 Medium · Not analysed yet · Published 22 Nov 2023 · Tags: CWE-1104 - [Kibana path traversal issue](https://agentprime.io/advisories/CVE-2021-22151.md) `CVE-2021-22151` · CVE record: Elastic Kibana · CVSS 3.1 Low · Not analysed yet · Published 22 Nov 2023 · Tags: Path traversal - [Kibana code execution issue](https://agentprime.io/advisories/CVE-2021-22150.md) `CVE-2021-22150` · CVE record: Elastic Kibana · CVSS 6.6 Medium · Not analysed yet · Published 22 Nov 2023 · Tags: Code injection - [Kibana Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2023-31422.md) `CVE-2023-31422` · CVE record: Elastic Kibana · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2023 · Tags: Information disclosure - [Code injection in Elastic Kibana](https://agentprime.io/advisories/CVE-2023-31415.md) `CVE-2023-31415` · CVE record: Elastic Kibana · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 May 2023 · Tags: Code injection - [Code injection in Elastic Kibana](https://agentprime.io/advisories/CVE-2023-31414.md) `CVE-2023-31414` · CVE record: Elastic Kibana · CVSS 8.2 High · Not analysed yet · Published 4 May 2023 · Tags: Code injection - [Open redirect in Elastic kibana](https://agentprime.io/advisories/CVE-2022-38779.md) `CVE-2022-38779` · CVE record: Elastic kibana · No CVSS score · Not analysed yet · Published 21 Feb 2023 · Tags: Open redirect - [Improper input validation in Elastic kibana](https://agentprime.io/advisories/CVE-2022-38778.md) `CVE-2022-38778` · CVE record: Elastic kibana · CVSS 6.5 Medium · Not analysed yet · Published 8 Feb 2023 · Tags: CWE-20 - [Cross-site scripting in Elastic Kibana](https://agentprime.io/advisories/CVE-2021-37936.md) `CVE-2021-37936` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 18 Nov 2022 · Tags: Cross-site scripting (XSS) - [Open redirect in Elastic Kibana](https://agentprime.io/advisories/CVE-2021-22141.md) `CVE-2021-22141` · CVE record: Elastic Kibana · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2022 · Tags: Open redirect - [Cross-site scripting in Elastic kibana](https://agentprime.io/advisories/CVE-2022-23713.md) `CVE-2022-23713` · CVE record: Elastic kibana · No CVSS score · Not analysed yet · Published 6 Jul 2022 · Tags: Cross-site scripting (XSS) - [Information disclosure in Elastic kibana](https://agentprime.io/advisories/CVE-2022-23711.md) `CVE-2022-23711` · CVE record: Elastic kibana · No CVSS score · Not analysed yet · Published 21 Apr 2022 · Tags: Information disclosure - [Elastic kibana: A flaw was discovered in Kibana in which users with Read access to the Uptime feature…](https://agentprime.io/advisories/CVE-2022-23709.md) `CVE-2022-23709` · CVE record: Elastic kibana · No CVSS score · Not analysed yet · Published 3 Mar 2022 · Tags: CWE-264 - [Cross-site scripting in Elastic Kibana](https://agentprime.io/advisories/CVE-2022-23707.md) `CVE-2022-23707` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 11 Feb 2022 · Tags: Cross-site scripting (XSS) - [Improper privilege management in Elastic Kibana](https://agentprime.io/advisories/CVE-2021-37938.md) `CVE-2021-37938` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 18 Nov 2021 · Tags: Privilege escalation - [Uncontrolled resource consumption in Elastic Kibana](https://agentprime.io/advisories/CVE-2021-22139.md) `CVE-2021-22139` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 13 May 2021 · Tags: Denial of service - [Insufficient session expiration in Elastic Kibana](https://agentprime.io/advisories/CVE-2021-22136.md) `CVE-2021-22136` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 13 May 2021 · Tags: Authentication bypass - [Cross-site scripting in Elastic Kibana](https://agentprime.io/advisories/CVE-2020-7017.md) `CVE-2020-7017` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 27 Jul 2020 · Tags: Cross-site scripting (XSS) - [Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion.](https://agentprime.io/advisories/CVE-2020-7016.md) `CVE-2020-7016` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 27 Jul 2020 · Tags: CWE-185 - [Cross-site scripting in Elastic Kibana](https://agentprime.io/advisories/CVE-2020-7015.md) `CVE-2020-7015` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 3 Jun 2020 · Tags: Cross-site scripting (XSS) - [Code injection in Elastic Kibana](https://agentprime.io/advisories/CVE-2020-7013.md) `CVE-2020-7013` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 3 Jun 2020 · Tags: Code injection - [Code injection in Elastic Kibana](https://agentprime.io/advisories/CVE-2020-7012.md) `CVE-2020-7012` · CVE record: Elastic Kibana · No CVSS score · EPSS 0.18 · Not analysed yet · Published 3 Jun 2020 · Tags: Code injection - [Cross-site scripting in Elastic Kibana](https://agentprime.io/advisories/CVE-2019-7621.md) `CVE-2019-7621` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 18 Dec 2019 · Tags: Cross-site scripting (XSS) - [Server-side request forgery in Elastic Kibana](https://agentprime.io/advisories/CVE-2019-7616.md) `CVE-2019-7616` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 30 Jul 2019 · Tags: Server-side request forgery (SSRF) - [Code injection in Elastic Kibana](https://agentprime.io/advisories/CVE-2019-7610.md) `CVE-2019-7610` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 25 Mar 2019 · Tags: Code injection - [Cross-site scripting in Elastic Kibana](https://agentprime.io/advisories/CVE-2019-7608.md) `CVE-2019-7608` · CVE record: Elastic Kibana · No CVSS score · Not analysed yet · Published 25 Mar 2019 · Tags: Cross-site scripting (XSS) - [Code injection in Elastic Kibana](https://agentprime.io/advisories/CVE-2019-7609.md) `CVE-2019-7609` · CVE record: Elastic Kibana · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.95 · Not analysed yet · Published 25 Mar 2019 · Tags: Code injection - [External control of a file path in Elastic Kibana](https://agentprime.io/advisories/CVE-2018-17246.md) `CVE-2018-17246` · CVE record: Elastic Kibana · No CVSS score · EPSS 0.84 · Not analysed yet · Published 20 Dec 2018 · Tags: Path traversal Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .