Advisories · Technology

Elastic Kibana.

Every CVE that names Elastic Kibana among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-68385 CVE record

CVSS 7.2 High

Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 18 Dec 2025
CVE-2025-37732 CVE record

CVSS 5.4 Medium

Kibana Cross-site Scripting via the Integration Package Upload Functionality
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 15 Dec 2025
CVE-2025-37734 CVE record

CVSS 4.3 Medium

Kibana Origin Validation Error
- Elastic Kibana
- CWE-346
Not analysed yet 12 Nov 2025
CVE-2025-37735 CVE record

CVSS 7.0 High

Improper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary files on the system being deleted by the Defend service running as SYSTEM.
- Elastic Kibana
- CWE-281
Not analysed yet 6 Nov 2025
CVE-2025-25017 CVE record

CVSS 8.2 High

Kibana Stored Cross-Site Scripting (XSS)
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2025
CVE-2025-25018 CVE record

CVSS 8.7 High

Kibana Stored Cross-Site Scripting (XSS)
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2025
CVE-2025-25009 CVE record

CVSS 8.7 High

Kibana Cross-Site Scripting (XSS)
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 7 Oct 2025
CVE-2025-37728 CVE record

CVSS 5.4 Medium

Kibana Insufficiently Protected Credentials in the CrowdStrike Connector
- Elastic Kibana
- Hard-coded credentials
Not analysed yet 7 Oct 2025
CVE-2025-25010 CVE record

CVSS 6.5 Medium

Kibana privilege escalation via reporting_user role
- Elastic Kibana
- Broken access control
Not analysed yet 28 Aug 2025
CVE-2025-25012 CVE record

CVSS 4.3 Medium

Kibana Open Redirect
- Elastic Kibana
- Open redirect
Not analysed yet 25 Jun 2025
CVE-2024-43706 CVE record

CVSS 7.6 High

Kibana Improper Authorization
- Elastic Kibana
- Broken access control
Not analysed yet 10 Jun 2025
CVE-2025-25014 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Kibana arbitrary code execution via prototype pollution
- Elastic Kibana
- Prototype pollution
Not analysed yet 6 May 2025
CVE-2024-11390 CVE record

CVSS 5.4 Medium

Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
- Elastic Kibana
- Unrestricted file upload
Not analysed yet 1 May 2025
CVE-2025-25016 CVE record

CVSS 4.3 Medium

Kibana Unrestricted Upload of File
- Elastic Kibana
- Unrestricted file upload
Not analysed yet 1 May 2025
CVE-2024-12556 CVE record

CVSS 8.7 High

Kibana Prototype Pollution can lead to code injection
- Elastic Kibana
- Prototype pollution
Not analysed yet 8 Apr 2025
CVE-2024-52974 CVE record

CVSS 6.5 Medium

Uncontrolled resource consumption in Elastic Kibana
- Elastic Kibana
- Denial of service
Not analysed yet 8 Apr 2025
CVE-2025-25015 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Kibana arbitrary code execution via prototype pollution
- Elastic Kibana
- Prototype pollution
Not analysed yet 5 Mar 2025
CVE-2024-43708 CVE record

CVSS 6.5 Medium

Resource allocation without limits in Elastic Kibana
- Elastic Kibana
- Denial of service
Not analysed yet 23 Jan 2025
CVE-2024-52972 CVE record

CVSS 6.5 Medium

Kibana allocation of resources without limits or throttling leads to crash
- Elastic Kibana
- Denial of service
Not analysed yet 23 Jan 2025
CVE-2024-43707 CVE record

CVSS 7.7 High

Kibana exposure of sensitive information to an unauthorized actor
- Elastic Kibana
- Information disclosure
Not analysed yet 23 Jan 2025
CVE-2024-43710 CVE record

CVSS 4.3 Medium

Kibana server-side request forgery
- Elastic Kibana
- Server-side request forgery (SSRF)
Not analysed yet 23 Jan 2025
CVE-2024-52973 CVE record

CVSS 6.5 Medium

Kibana allocation of resources without limits or throttling leads to crash
- Elastic Kibana
- Denial of service
Not analysed yet 21 Jan 2025
CVE-2024-37285 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Kibana arbitrary code execution via YAML deserialization
- Elastic Kibana
- Insecure deserialization
Not analysed yet 14 Nov 2024
CVE-2024-37288 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Deserialization of untrusted data in Elastic Kibana
- Elastic Kibana
- Insecure deserialization
Not analysed yet 9 Sept 2024
CVE-2024-37287 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Kibana arbitrary code execution via prototype pollution
- Elastic Kibana
- Code injection
Not analysed yet 13 Aug 2024
CVE-2024-37281 CVE record

CVSS 6.5 Medium

Kibana Denial of Service issue
- Elastic Kibana
- Denial of service
Not analysed yet 30 Jul 2024
CVE-2024-23443 CVE record

CVSS 4.9 Medium

Uncontrolled resource consumption in Elastic Kibana
- Elastic Kibana
- Denial of service
Not analysed yet 19 Jun 2024
CVE-2024-23442 CVE record

CVSS 6.1 Medium

Kibana open redirect issue
- Elastic Kibana
- Open redirect
Not analysed yet 14 Jun 2024
CVE-2024-37279 CVE record

CVSS 4.3 Medium

Kibana Broken Access Control issue
- Elastic Kibana
- Broken access control
Not analysed yet 13 Jun 2024
CVE-2024-23446 CVE record

CVSS 6.5 Medium

Kibana Broken Access Control issue
- Elastic Kibana
- Broken access control
Not analysed yet 7 Feb 2024
CVE-2023-46675 CVE record

CVSS 8.0 High

Kibana Insertion of Sensitive Information into Log File
- Elastic Kibana
- Information disclosure
Not analysed yet 13 Dec 2023
CVE-2023-46671 CVE record

CVSS 8.0 High

Kibana Insertion of Sensitive Information into Log File
- Elastic Kibana
- Information disclosure
Not analysed yet 13 Dec 2023
CVE-2021-22142 CVE record

CVSS 6.6 Medium

Kibana Reporting vulnerabilities
- Elastic Kibana
- CWE-1104
Not analysed yet 22 Nov 2023
CVE-2021-22151 CVE record

CVSS 3.1 Low

Kibana path traversal issue
- Elastic Kibana
- Path traversal
Not analysed yet 22 Nov 2023
CVE-2021-22150 CVE record

CVSS 6.6 Medium

Kibana code execution issue
- Elastic Kibana
- Code injection
Not analysed yet 22 Nov 2023
CVE-2023-31422 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Kibana Insertion of Sensitive Information into Log File
- Elastic Kibana
- Information disclosure
Not analysed yet 26 Oct 2023
CVE-2023-31415 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Code injection in Elastic Kibana
- Elastic Kibana
- Code injection
Not analysed yet 4 May 2023
CVE-2023-31414 CVE record

CVSS 8.2 High

Code injection in Elastic Kibana
- Elastic Kibana
- Code injection
Not analysed yet 4 May 2023
CVE-2022-38779 CVE record

Open redirect in Elastic kibana
- Elastic kibana
- Open redirect
Not analysed yet 21 Feb 2023
CVE-2022-38778 CVE record

CVSS 6.5 Medium

Improper input validation in Elastic kibana
- Elastic kibana
- CWE-20
Not analysed yet 8 Feb 2023
CVE-2021-37936 CVE record

CVSS 5.4 Medium

Cross-site scripting in Elastic Kibana
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 18 Nov 2022
CVE-2021-22141 CVE record

CVSS 6.1 Medium

Open redirect in Elastic Kibana
- Elastic Kibana
- Open redirect
Not analysed yet 18 Nov 2022
CVE-2022-23713 CVE record

Cross-site scripting in Elastic kibana
- Elastic kibana
- Cross-site scripting (XSS)
Not analysed yet 6 Jul 2022
CVE-2022-23711 CVE record

Information disclosure in Elastic kibana
- Elastic kibana
- Information disclosure
Not analysed yet 21 Apr 2022
CVE-2022-23709 CVE record

Elastic kibana: A flaw was discovered in Kibana in which users with Read access to the Uptime feature…
- Elastic kibana
- CWE-264
Not analysed yet 3 Mar 2022
CVE-2022-23707 CVE record

Cross-site scripting in Elastic Kibana
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 11 Feb 2022
CVE-2021-37938 CVE record

Improper privilege management in Elastic Kibana
- Elastic Kibana
- Privilege escalation
Not analysed yet 18 Nov 2021
CVE-2021-22139 CVE record

Uncontrolled resource consumption in Elastic Kibana
- Elastic Kibana
- Denial of service
Not analysed yet 13 May 2021
CVE-2021-22136 CVE record

Insufficient session expiration in Elastic Kibana
- Elastic Kibana
- Authentication bypass
Not analysed yet 13 May 2021
CVE-2020-7017 CVE record

Cross-site scripting in Elastic Kibana
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 27 Jul 2020
CVE-2020-7016 CVE record

Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion.
- Elastic Kibana
- CWE-185
Not analysed yet 27 Jul 2020
CVE-2020-7015 CVE record

Cross-site scripting in Elastic Kibana
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 3 Jun 2020
CVE-2020-7013 CVE record

Code injection in Elastic Kibana
- Elastic Kibana
- Code injection
Not analysed yet 3 Jun 2020
CVE-2020-7012 CVE record

Code injection in Elastic Kibana
- Elastic Kibana
- Code injection
Not analysed yet 3 Jun 2020
CVE-2019-7621 CVE record

Cross-site scripting in Elastic Kibana
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 18 Dec 2019
CVE-2019-7616 CVE record

Server-side request forgery in Elastic Kibana
- Elastic Kibana
- Server-side request forgery (SSRF)
Not analysed yet 30 Jul 2019
CVE-2019-7610 CVE record

Code injection in Elastic Kibana
- Elastic Kibana
- Code injection
Not analysed yet 25 Mar 2019
CVE-2019-7608 CVE record

Cross-site scripting in Elastic Kibana
- Elastic Kibana
- Cross-site scripting (XSS)
Not analysed yet 25 Mar 2019
CVE-2019-7609 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

Code injection in Elastic Kibana
- Elastic Kibana
- Code injection
Not analysed yet 25 Mar 2019
CVE-2018-17246 CVE record

External control of a file path in Elastic Kibana
- Elastic Kibana
- Path traversal
Not analysed yet 20 Dec 2018