# Elastic Kibana. Every CVE that names Elastic Kibana among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions](https://agentprime.io/advisories/CVE-2026-72664.md) `CVE-2026-72664` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources](https://agentprime.io/advisories/CVE-2026-72677.md) `CVE-2026-72677` · CVE record: Elastic Kibana · CVSS 7.3 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal - [Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification](https://agentprime.io/advisories/CVE-2026-72675.md) `CVE-2026-72675` · CVE record: Elastic Kibana · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-72674.md) `CVE-2026-72674` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations](https://agentprime.io/advisories/CVE-2026-72673.md) `CVE-2026-72673` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data](https://agentprime.io/advisories/CVE-2026-72672.md) `CVE-2026-72672` · CVE record: Elastic Kibana · CVSS 7.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments](https://agentprime.io/advisories/CVE-2026-72671.md) `CVE-2026-72671` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials](https://agentprime.io/advisories/CVE-2026-72670.md) `CVE-2026-72670` · CVE record: Elastic Kibana · CVSS 7.7 High · Not analysed yet · Published 13 Aug 2026 · Tags: Information disclosure - [Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering](https://agentprime.io/advisories/CVE-2026-72669.md) `CVE-2026-72669` · CVE record: Elastic Kibana · CVSS 7.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure](https://agentprime.io/advisories/CVE-2026-72681.md) `CVE-2026-72681` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification](https://agentprime.io/advisories/CVE-2026-72680.md) `CVE-2026-72680` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-49089.md) `CVE-2026-49089` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Denial of service - [Missing Authorization in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-63262.md) `CVE-2026-63262` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63261.md) `CVE-2026-63261` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63260.md) `CVE-2026-63260` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-63259.md) `CVE-2026-63259` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromise](https://agentprime.io/advisories/CVE-2026-63145.md) `CVE-2026-63145` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Unauthorized Information Disclosure](https://agentprime.io/advisories/CVE-2026-63143.md) `CVE-2026-63143` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-63142.md) `CVE-2026-63142` · CVE record: Elastic Kibana · CVSS 5.0 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions](https://agentprime.io/advisories/CVE-2026-63141.md) `CVE-2026-63141` · CVE record: Elastic Kibana · CVSS 6.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-63139.md) `CVE-2026-63139` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Information Disclosure and Case Attachment Integrity Compromise](https://agentprime.io/advisories/CVE-2026-56147.md) `CVE-2026-56147` · CVE record: Elastic Kibana · CVSS 7.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Improper Access Control in Kibana Leading to Unauthorized Data Modification and Information Disclosure](https://agentprime.io/advisories/CVE-2026-56146.md) `CVE-2026-56146` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-42397.md) `CVE-2026-42397` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Denial of service - [Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Information Exposure](https://agentprime.io/advisories/CVE-2026-49092.md) `CVE-2026-49092` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control - [Improper Output Neutralization for Logs in Kibana Leading to Log Injection](https://agentprime.io/advisories/CVE-2026-49091.md) `CVE-2026-49091` · CVE record: Elastic Kibana · CVSS 8.0 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-116 - [Insertion of Sensitive Information into Log File in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-49088.md) `CVE-2026-49088` · CVE record: Elastic Kibana · CVSS 4.4 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Information disclosure - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-49087.md) `CVE-2026-49087` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Denial of service - [Incorrect Authorization in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-56152.md) `CVE-2026-56152` · CVE record: Elastic Kibana · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Broken access control - [Improper Input Validation in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-56151.md) `CVE-2026-56151` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-20 - [Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access](https://agentprime.io/advisories/CVE-2026-49093.md) `CVE-2026-49093` · CVE record: Elastic Kibana · CVSS 6.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF) - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-49094.md) `CVE-2026-49094` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: Denial of service - [Improper Input Validation in Kibana Fleet Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-49095.md) `CVE-2026-49095` · CVE record: Elastic Kibana · CVSS 7.2 High · Not analysed yet · Published 28 May 2026 · Tags: CWE-20 - [Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access](https://agentprime.io/advisories/CVE-2026-42398.md) `CVE-2026-42398` · CVE record: Elastic Kibana · CVSS 7.7 High · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF) - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-42399.md) `CVE-2026-42399` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: Denial of service - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-42400.md) `CVE-2026-42400` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: Denial of service - [Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HTML Injection](https://agentprime.io/advisories/CVE-2026-42401.md) `CVE-2026-42401` · CVE record: Elastic Kibana · CVSS 4.1 Medium · Not analysed yet · Published 28 May 2026 · Tags: Cross-site scripting (XSS) - [Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access](https://agentprime.io/advisories/CVE-2026-33463.md) `CVE-2026-33463` · CVE record: Elastic Kibana · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: CWE-672 - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-33464.md) `CVE-2026-33464` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: Denial of service - [Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts](https://agentprime.io/advisories/CVE-2026-33462.md) `CVE-2026-33462` · CVE record: Elastic Kibana · CVSS 4.6 Medium · Not analysed yet · Published 28 May 2026 · Tags: Path traversal - [Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-33458.md) `CVE-2026-33458` · CVE record: Elastic Kibana · CVSS 6.8 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Server-side request forgery (SSRF) - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-33459.md) `CVE-2026-33459` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Denial of service - [Incorrect Authorization in Kibana Fleet Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-33460.md) `CVE-2026-33460` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control - [Incorrect Authorization in Kibana Fleet Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-33461.md) `CVE-2026-33461` · CVE record: Elastic Kibana · CVSS 7.7 High · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control - [Execution with Unnecessary Privileges in Kibana Leading to reading index data beyond their direct Elasticsearch RBAC scope](https://agentprime.io/advisories/CVE-2026-4498.md) `CVE-2026-4498` · CVE record: Elastic Kibana · CVSS 7.7 High · Not analysed yet · Published 8 Apr 2026 · Tags: Privilege escalation - [Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-26940.md) `CVE-2026-26940` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-1284 - [Missing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration](https://agentprime.io/advisories/CVE-2026-26939.md) `CVE-2026-26939` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Broken access control - [Improper Neutralization of Special Elements Used in a Template Engine in Kibana Workflows Leading to Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2026-26938.md) `CVE-2026-26938` · CVE record: Elastic Kibana · CVSS 8.6 High · Not analysed yet · Published 26 Feb 2026 · Tags: Code injection - [Uncontrolled Resource Consumption in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-26937.md) `CVE-2026-26937` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Denial of service - [Inefficient Regular Expression Complexity in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-26936.md) `CVE-2026-26936` · CVE record: Elastic Kibana · CVSS 4.9 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Denial of service - [Improper Input Validation in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-26935.md) `CVE-2026-26935` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-20 - [Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-26934.md) `CVE-2026-26934` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-1284 - [External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector](https://agentprime.io/advisories/CVE-2026-0532.md) `CVE-2026-0532` · CVE record: Elastic Kibana · CVSS 8.6 High · Not analysed yet · Published 14 Jan 2026 · Tags: Server-side request forgery (SSRF) - [Improper Input Validation in Kibana Email Connector Leading to Excessive Allocation](https://agentprime.io/advisories/CVE-2026-0543.md) `CVE-2026-0543` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-20 - [Allocation of Resources Without Limits or Throttling in Kibana Fleet](https://agentprime.io/advisories/CVE-2026-0531.md) `CVE-2026-0531` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Denial of service - [Allocation of Resources Without Limits or Throttling in Kibana Leading to Excessive Allocation](https://agentprime.io/advisories/CVE-2026-0530.md) `CVE-2026-0530` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: Denial of service - [Kibana Improper Authorization](https://agentprime.io/advisories/CVE-2025-68422.md) `CVE-2025-68422` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Broken access control - [Kibana Improper Authorization](https://agentprime.io/advisories/CVE-2025-68386.md) `CVE-2025-68386` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Broken access control - [Kibana Allocation of Resources Without Limits or Throttling](https://agentprime.io/advisories/CVE-2025-68389.md) `CVE-2025-68389` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Denial of service - [Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://agentprime.io/advisories/CVE-2025-68387.md) `CVE-2025-68387` · CVE record: Elastic Kibana · CVSS 6.1 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Cross-site scripting (XSS) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .