Elastic Cloud CVEs
231 vulnerabilities mapped to Elastic Cloud’s software or packages, 3 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2025-25012 Kibana Open Redirect
CVSS 4.3 mediumEPSS 0.44%
CVE-2024-43706 Kibana Improper Authorization
CVSS 7.6 highEPSS 0.44%
CVE-2025-25014 Kibana arbitrary code execution via prototype pollution
CVSS 9.1 criticalEPSS 22.3%
CVE-2025-37730 Logstash Improper Certificate Validation in TCP output
CVSS 6.5 mediumEPSS 0.18%
CVE-2024-52979 Elasticsearch Uncontrolled Resource Consumption vulnerability
CVSS 6.5 mediumEPSS 0.65%
CVE-2024-11390 Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
CVSS 5.4 mediumEPSS 0.35%
CVE-2025-25016 Kibana Unrestricted Upload of File
CVSS 4.3 mediumEPSS 0.34%
CVE-2024-11994 APM Server Insertion of Sensitive Information into Log File
CVSS 5.7 mediumEPSS 0.26%
CVE-2024-52976 Elastic Agent Inclusion of Functionality from Untrusted Control Sphere
CVSS 4.4 mediumEPSS 0.20%
CVE-2023-46669 Elastic Agent / Elastic Endpoint Security local API key disclosure
CVSS 6.2 mediumEPSS 0.20%
CVE-2025-25013 Elastic Defend Insertion of Sensitive Information into Log Files
CVSS 6.5 mediumEPSS 0.36%
CVE-2024-12556 Kibana Prototype Pollution can lead to code injection
CVSS 8.7 highEPSS 0.55%
CVSS 4.9 mediumEPSS 0.58%
CVSS 6.5 mediumEPSS 0.41%
CVE-2024-52980 Elasticsearch Uncontrolled Resource Consumption vulnerability
CVSS 6.5 mediumEPSS 0.55%
CVE-2025-25015 Kibana arbitrary code execution via prototype pollution
CVSS 9.9 criticalEPSS 1.3%
CVSS 6.5 mediumEPSS 0.38%
CVE-2024-52975 Fleet Server sensitive information exposure via logs
CVSS 9.0 criticalEPSS 0.27%
CVE-2024-52972 Kibana allocation of resources without limits or throttling leads to crash
CVSS 6.5 mediumEPSS 0.38%
CVE-2024-43707 Kibana exposure of sensitive information to an unauthorized actor
CVSS 7.7 highEPSS 0.43%
CVE-2024-43710 Kibana server-side request forgery
CVSS 4.3 mediumEPSS 0.26%
CVE-2024-52973 Kibana allocation of resources without limits or throttling leads to crash
CVSS 6.5 mediumEPSS 0.37%
CVE-2024-43709 Elasticsearch allocation of resources without limits or throttling leads to crash
CVSS 6.5 mediumEPSS 0.62%
CVE-2024-37284 Elastic Defend Improper Handling of Alternate Encoding Leads to Crash
CVSS 5.5 mediumEPSS 0.16%
CVE-2024-12539 Elasticsearch Incorrect Authorization
CVSS 6.5 mediumEPSS 0.46%
CVE-2024-37285 Kibana arbitrary code execution via YAML deserialization
CVSS 9.1 criticalEPSS 1.2%
CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 99.9%
CVE-2014-3120 Elasticsearch Remote Code Execution Vulnerability
CVSS 8.1 highKEV added EPSS 88.6%
CVE-2019-7609 Kibana Arbitrary Code Execution
CVSS 9.8 criticalKEV added EPSS 95.3%
All vendors’ CVEs · JSON · Markdown
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)