CVEs for Elastic Cloud
231 matching vulnerabilities, 3 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2025-25012 Kibana Open Redirect
CVSS 4.3 mediumEPSS 0.44%Elastic Cloud
CVE-2024-43706 Kibana Improper Authorization
CVSS 7.6 highEPSS 0.44%Elastic Cloud
CVE-2025-25014 Kibana arbitrary code execution via prototype pollution
CVSS 9.1 criticalEPSS 22.3%Elastic Cloud
CVE-2025-37730 Logstash Improper Certificate Validation in TCP output
CVSS 6.5 mediumEPSS 0.18%Elastic Cloud
CVE-2024-52979 Elasticsearch Uncontrolled Resource Consumption vulnerability
CVSS 6.5 mediumEPSS 0.65%Elastic Cloud
CVE-2024-11390 Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
CVSS 5.4 mediumEPSS 0.35%Elastic Cloud
CVE-2025-25016 Kibana Unrestricted Upload of File
CVSS 4.3 mediumEPSS 0.34%Elastic Cloud
CVE-2024-11994 APM Server Insertion of Sensitive Information into Log File
CVSS 5.7 mediumEPSS 0.26%Elastic Cloud
CVE-2024-52976 Elastic Agent Inclusion of Functionality from Untrusted Control Sphere
CVSS 4.4 mediumEPSS 0.20%Elastic Cloud
CVE-2023-46669 Elastic Agent / Elastic Endpoint Security local API key disclosure
CVSS 6.2 mediumEPSS 0.20%Elastic Cloud
CVE-2025-25013 Elastic Defend Insertion of Sensitive Information into Log Files
CVSS 6.5 mediumEPSS 0.36%Elastic Cloud
CVE-2024-12556 Kibana Prototype Pollution can lead to code injection
CVSS 8.7 highEPSS 0.55%Elastic Cloud
CVSS 4.9 mediumEPSS 0.58%Elastic Cloud
CVSS 6.5 mediumEPSS 0.41%Elastic Cloud
CVE-2024-52980 Elasticsearch Uncontrolled Resource Consumption vulnerability
CVSS 6.5 mediumEPSS 0.55%Elastic Cloud
CVE-2025-25015 Kibana arbitrary code execution via prototype pollution
CVSS 9.9 criticalEPSS 1.3%Elastic Cloud
CVSS 6.5 mediumEPSS 0.38%Elastic Cloud
CVE-2024-52975 Fleet Server sensitive information exposure via logs
CVSS 9.0 criticalEPSS 0.27%Elastic Cloud
CVE-2024-52972 Kibana allocation of resources without limits or throttling leads to crash
CVSS 6.5 mediumEPSS 0.38%Elastic Cloud
CVE-2024-43707 Kibana exposure of sensitive information to an unauthorized actor
CVSS 7.7 highEPSS 0.43%Elastic Cloud
CVE-2024-43710 Kibana server-side request forgery
CVSS 4.3 mediumEPSS 0.26%Elastic Cloud
CVE-2024-52973 Kibana allocation of resources without limits or throttling leads to crash
CVSS 6.5 mediumEPSS 0.37%Elastic Cloud
CVE-2024-37284 Elastic Defend Improper Handling of Alternate Encoding Leads to Crash
CVSS 5.5 mediumEPSS 0.16%Elastic Cloud
CVE-2024-12539 Elasticsearch Incorrect Authorization
CVSS 6.5 mediumEPSS 0.46%Elastic Cloud
CVE-2024-37285 Kibana arbitrary code execution via YAML deserialization
CVSS 9.1 criticalEPSS 1.2%Elastic Cloud
CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 99.9%Elastic Cloud
CVE-2014-3120 Elasticsearch Remote Code Execution Vulnerability
CVSS 8.1 highKEV added EPSS 88.6%Elastic Cloud
CVE-2019-7609 Kibana Arbitrary Code Execution
CVSS 9.8 criticalKEV added EPSS 95.3%Elastic Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)