CVE-2026-106562 - Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-s

CVE-2026-103009 - Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information

CVE-2026-103008 - Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially craf

CVE-2026-103007 - Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated

CVE-2026-103006 - Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially craf

CVE-2026-103005 - Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service

CVE-2026-102413 - Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially craft

CVE-2026-102411 - Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial o

CVE-2026-102409 - Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privilege

CVE-2026-102408 - Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service

CVE-2026-102407 - Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification

CVE-2026-102406 - Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data

CVE-2026-102404 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces

CVE-2026-105315 - A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python o

CVE-2026-94408 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessiv

CVE-2026-94399 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessiv

CVE-2026-94398 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessiv

CVE-2026-94397 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessiv

CVE-2026-94396 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessiv

CVE-2026-82300 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces

CVE-2026-82294 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces

CVE-2026-78582 - Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting I

CVE-2026-72668 - Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to p

CVE-2026-100696 - Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnera

CVE-2026-82409 - Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/commo

CVE-2026-92468 - zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the s

CVE-2026-92466 - zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where th

CVE-2026-73579 - Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into

CVE-2026-90772 - Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslyS

CVE-2026-62088 - Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve

CVE-2026-89261 - MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service wit

CVE-2026-86079 - n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elast

CVE-2026-78593 - An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticate

CVE-2026-78583 - Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipula

CVE-2026-85167 - n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsea

CVE-2026-78609 - Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modi

CVE-2026-78604 - Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local p

CVE-2026-78602 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic M

CVE-2026-78601 - Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CA

CVE-2026-78600 - Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access vi

CVE-2026-78607 - Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to informatio

CVE-2026-78606 - Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and d

CVE-2026-78605 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch c

CVE-2026-78603 - Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrec

CVE-2026-78597 - Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credenti

CVE-2026-72654 - Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to i

CVE-2026-72649 - Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead

CVE-2026-72633 - Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitori

CVE-2026-56143 - Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial

CVE-2026-76211 - phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endp

CVE-2026-72687 - A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request

CVE-2026-72686 - A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request contai

CVE-2026-72685 - A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit

CVE-2026-72684 - A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small

CVE-2026-72683 - A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simu

CVE-2026-72679 - Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern ac

CVE-2026-72678 - Elasticsearch does not validate a size value taken from a user-supplied input before that value is u

CVE-2026-72675 - Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unautho

CVE-2026-72672 - The Elastic Security capability that suggests existing field values while a user authors endpoint po

CVE-2026-72666 - Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query

CVE-2026-72665 - Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic

CVE-2026-72664 - Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend respo

CVE-2026-72661 - Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functiona

CVE-2026-72656 - Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch

CVE-2026-72655 - Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case

CVE-2026-72648 - Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on

CVE-2026-72647 - Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data

CVE-2026-72645 - Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service

CVE-2026-72643 - Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user ide

CVE-2026-72642 - The native inference process that Elasticsearch uses to evaluate uploaded machine learning models ac

CVE-2026-72640 - The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation

CVE-2026-72639 - Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highligh

CVE-2026-72638 - Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manip

CVE-2026-72636 - Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial

CVE-2026-72632 - Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (

CVE-2026-72631 - Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privile

CVE-2026-72630 - Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abu

CVE-2026-19111 - Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools

CVE-2026-63263 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Expon

CVE-2026-63144 - Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially craf

CVE-2026-61053 - Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communica

CVE-2026-63140 - Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipula

CVE-2026-63136 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces

CVE-2026-56145 - Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces

CVE-2026-56144 - Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited inde