Elastic Kibana

Name: Elastic Kibana
Brand: Elastic

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

6critical20high48medium3low

updated 2026-10-27

vulnerabilities (153)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-7609US	critical10.0OT critical	95.3% (100th)	KEV	no fix	2019-03-25	≤ before 5.6.15 and 6.6.1
CVE-2018-17246US	critical9.8	84.3% (100th)	Exploit	no fix	2018-12-20	≤ before 6.4.3 and 5.6.13
CVE-2025-25014US	critical9.8	22.3% (98th)	Exploit	9.0.1	2025-05-06	3 versions
CVE-2020-7012US	high8.8	18.2% (97th)	Exploit	no fix	2020-06-03	≤ 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2
CVE-2019-7616US	medium4.9	2.40% (84th)	Exploit	no fix	2019-07-30	≤ before 7.2.1 and 6.8.2
CVE-2024-23443US	medium4.9	1.76% (78th)	Exploit	8.14.0	2024-06-19	2 versions
CVE-2019-7610US	critical9.0	3.89% (90th)	—	no fix	2019-03-25	≤ before 6.6.1
CVE-2020-7013US	high7.2	2.15% (82nd)	—	no fix	2020-06-03	≤ before 6.8.9 and 7.7.0
CVE-2024-37287US	high7.2	1.65% (76th)	—	7.17.23, 8.14.2	2024-08-13	7.7.0, 8.0.0 → 7.17.23, 8.14.2
CVE-2018-3830US	medium6.1	1.63% (76th)	—	no fix	2018-09-19	≤ after 5.3.0, before 5.6.12 and 6.4.1
CVE-2018-17245US	critical9.8	1.52% (75th)	—	no fix	2018-12-20	≤ 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2
CVE-2017-8452US	high7.5	1.38% (72nd)	—	no fix	2017-06-16	≤ before 5.2.1
CVE-2019-7608US	medium6.1	1.33% (71st)	—	no fix	2019-03-25	≤ before 5.6.15 and 6.6.1
CVE-2025-25015US	—	1.31% (71st)	—	8.17.3	2025-03-05	4 versions
CVE-2024-37285US	high7.2	1.25% (69th)	—	no fix	2024-11-14	≤ 8.10.0 ≤8.15.0
CVE-2020-7017US	medium6.7	1.22% (69th)	—	no fix	2020-07-27	≤ before 6.8.11 and 7.8.1
CVE-2021-22150US	high7.2	1.15% (67th)	—	7.14.0	2023-11-22	7.10.2 → 7.14.0
CVE-2020-7016US	medium4.8	1.08% (65th)	—	no fix	2020-07-27	≤ before 6.8.11 and 7.8.1
CVE-2024-37288US	high8.8	1.04% (64th)	—	no fix	2024-09-09	≤ 8.15.0
CVE-2018-3818US	medium6.1	1.03% (64th)	—	no fix	2018-03-30	≤ 5.1.1 to 6.1.2 and 5.6.6
CVE-2016-10365US	medium6.1	1.02% (63rd)	—	no fix	2017-06-16	≤ before 5.0.1 and 4.6.3
CVE-2021-22142US	high8.8	1.01% (63rd)	—	7.13.0	2023-11-22	7.0.0 → 7.13.0
CVE-2021-22139US	medium6.5	1.00% (63rd)	—	no fix	2021-05-13	≤ before 7.12.1
CVE-2017-8440US	medium6.1	0.99% (62nd)	—	no fix	2017-06-05	2 versions
CVE-2017-8439US	medium6.1	0.99% (62nd)	—	no fix	2017-06-05	≤ 5.4.0
CVE-2023-31415US	high8.8	0.96% (61st)	—	no fix	2023-05-04	≤ version 8.7.0
CVE-2016-10366US	medium6.1	0.94% (61st)	—	no fix	2017-06-16	≤ 4.3 to 4.6.2
CVE-2022-23711US	medium5.3	0.92% (60th)	—	no fix	2022-04-21	≤ Versions 7.2.1 through 7.17.2 & 8.0.0 through 8.1.2
CVE-2018-3821US	medium6.1	0.90% (59th)	—	no fix	2018-03-30	≤ after 5.1.1 and before 5.6.7 and 6.1.3
CVE-2022-38778US	medium6.5	0.89% (59th)	—	no fix	2023-02-08	≤ Versions 7.0.0 through 7.17.8 and 8.0.0 through 8.6.0
CVE-2018-3820US	medium6.1	0.84% (58th)	—	no fix	2018-03-30	≤ after 6.1.0 and before 6.1.3
CVE-2017-11481US	medium6.1	0.84% (58th)	—	no fix	2017-12-08	≤ before 6.0.1 and 5.6.5
CVE-2018-3819US	medium6.1	0.84% (58th)	—	no fix	2018-03-30	≤ All versions before 6.1.3 and 5.6.7
CVE-2022-23713US	medium6.1	0.83% (57th)	—	no fix	2022-07-06	≤ Versions 7.0.0 through 7.17.4 and 8.0.0 through 8.2.3
CVE-2015-9056US	medium6.1	0.83% (57th)	—	no fix	2017-06-16	≤ before 4.1.3 and 4.2.1
CVE-2023-31422US	high7.5	0.78% (56th)	—	no fix	2023-10-26	≤ 8.10.0
CVE-2020-7015US	medium5.4	0.78% (56th)	—	no fix	2020-06-03	≤ before 6.8.9 and 7.7.0
CVE-2022-23710US	medium6.1	0.77% (55th)	—	no fix	2022-03-03	≤ For self-managed deployments the issue impacts versions 7.15.0, 7.15.1, and 7.15.2 For Elastic Cloud Services the issue impacts versions 7.15.0 through 7.17.0, and 8.0.0
CVE-2017-11482US	medium6.1	0.74% (54th)	—	no fix	2017-12-08	≤ before 6.0.1 and 5.6.5
CVE-2021-37938US	medium4.3	0.72% (54th)	—	no fix	2021-11-18	≤ All versions from 7.9.0 through 7.15.1
CVE-2019-7621US	medium5.4	0.71% (53rd)	—	no fix	2019-12-18	≤ before 6.8.6 and 7.5.1
CVE-2021-22151US	medium4.3	0.70% (53rd)	—	7.14.0	2023-11-22	7.9.0 → 7.14.0
CVE-2023-46675US	medium6.5	0.69% (53rd)	—	7.17.16	2023-12-13	2 versions
CVE-2023-46671US	medium6.5	0.66% (51st)	—	8.11.1	2023-12-13	8.0.0 → 8.11.1
CVE-2023-31414US	high8.8	0.60% (49th)	—	no fix	2023-05-04	≤ versions 8.0.0 through 8.7.0
CVE-2021-22141US	medium6.1	0.59% (48th)	—	no fix	2022-11-18	≤ All versions of Kibana before 7.13.0 and 6.8.16.
CVE-2024-12556US	critical9.8	0.55% (46th)	—	8.17.1	2025-04-08	8.16.1 → 8.17.1
CVE-2022-23709US	medium4.3OT elevated	0.55% (46th)	—	no fix	2022-03-03	≤ Versions 7.7.0 through 7.17.0, and 8.0.0
CVE-2022-23707US	medium5.4	0.53% (44th)	—	no fix	2022-02-11	≤ 7.5.1 through 7.16.3
CVE-2026-72660US	—	0.52% (44th)	—	no fix	2026-08-13	3 versions

showing 50 of 153

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')24 CVEs
CWE-770Allocation of Resources Without Limits or Throttling15 CVEs
CWE-400Uncontrolled Resource Consumption14 CVEs
CWE-863Incorrect Authorization13 CVEs
CWE-862Missing Authorization12 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')8 CVEs
CWE-20Improper Input Validation7 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')7 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)153 CVEs
NLNCSC-NL (CSAF)6 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan