Open Source Kibana

Name: Open Source Kibana
Brand: Open Source

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

unpatched

by severity

4critical13high17medium0low

updated 2026-10-27

vulnerabilities (148)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-7024US	high8.8OT critical	6.67% (94th)	KEV	7.17.18	2023-12-21	2 versions
CVE-2025-25014US	critical9.8	22.3% (98th)	Exploit	8.18.1	2025-05-06	3 versions
CVE-2025-2135US	—	6.57% (94th)	Exploit	7.17.29	2025-03-10	4 versions
CVE-2019-7616US	medium4.9	2.40% (84th)	Exploit	7.2.1	2019-07-30	2 versions
CVE-2021-22930US	critical9.8	36.5% (98th)	—	7.14.1	2021-10-07	< 7.14.1
CVE-2021-22931US	critical9.8	22.0% (98th)	—	7.14.1	2021-08-16	< 7.14.1
CVE-2021-22939US	medium5.3	14.7% (97th)	—	7.14.1	2021-08-16	< 7.14.1
CVE-2021-3672US	medium5.6	2.81% (86th)	—	7.14.1	2021-11-23	< 7.14.1
CVE-2025-25015US	—	1.31% (70th)	—	8.17.3	2025-03-05	< 8.17.3
CVE-2024-37285US	high7.2	1.25% (69th)	—	8.15.1	2024-11-14	< 8.15.1
CVE-2021-22150US	high7.2	1.15% (67th)	—	7.14.1	2023-11-22	< 7.14.1
CVE-2024-37288US	high8.8	1.04% (64th)	—	8.15.1	2024-09-09	< 8.15.1
CVE-2021-22151US	medium4.3	0.70% (53rd)	—	7.14.1	2023-11-22	< 7.14.1
CVE-2024-12556US	critical9.8	0.55% (46th)	—	8.15.1	2025-04-08	4 versions
CVE-2026-72660US	—	0.52% (44th)	—	8.19.20	2026-08-13	4 versions
CVE-2026-72654US	—	0.51% (43rd)	—	9.5.2	2026-09-01	3 versions
CVE-2021-37936US	medium5.4	0.50% (43rd)	—	7.14.1	2022-11-18	< 7.14.1
CVE-2026-63137US	—OT elevated	0.50% (43rd)	—	8.19.21	2026-09-01	3 versions
CVE-2026-0532US	—	0.49% (42nd)	—	9.2.4	2026-01-14	3 versions
CVE-2026-0531US	—	0.49% (42nd)	—	9.2.4	2026-01-13	3 versions
CVE-2026-72670US	medium6.5	0.48% (41st)	—	8.19.20	2026-08-13	4 versions
CVE-2026-78599US	—	0.48% (41st)	—	9.5.2	2026-09-02	3 versions
CVE-2026-78586US	—	0.47% (41st)	—	8.19.21	2026-09-02	3 versions
CVE-2026-72682US	—	0.47% (41st)	—	9.5.2	2026-09-01	3 versions
CVE-2026-72628US	—	0.47% (41st)	—	9.5.2	2026-09-01	3 versions
CVE-2026-72663US	—	0.47% (41st)	—	9.5.1	2026-08-13	4 versions
CVE-2026-49089US	—	0.47% (41st)	—	8.11.1	2026-08-13	3 versions
CVE-2026-63261US	—	0.47% (41st)	—	9.4.4	2026-07-21	6 versions
CVE-2026-63260US	—	0.47% (41st)	—	9.4.3	2026-07-21	6 versions
CVE-2026-63139US	—	0.47% (41st)	—	9.3.8	2026-07-21	6 versions
CVE-2026-56151US	—	0.47% (41st)	—	9.4.3	2026-07-01	12 versions
CVE-2026-49087US	—	0.47% (41st)	—	9.1.6	2026-07-01	6 versions
CVE-2026-72665US	—OT elevated	0.47% (40th)	—	9.5.1	2026-08-13	4 versions
CVE-2026-63138US	—	0.46% (40th)	—	9.5.2	2026-09-01	3 versions
CVE-2024-43706US	high8.8	0.44% (38th)	—	8.12.1	2025-06-10	< 8.12.1
CVE-2025-25012US	medium5.4	0.44% (38th)	—	7.17.29	2025-06-25	4 versions
CVE-2026-72681US	high8.8OT elevated	0.44% (38th)	—	9.5.1	2026-08-13	4 versions
CVE-2026-0543US	—	0.43% (37th)	—	9.1.10	2026-01-13	3 versions
CVE-2024-43707US	medium6.5	0.43% (37th)	—	8.15.0	2025-01-23	< 8.15.0
CVE-2025-59840US	—	0.42% (36th)	—	8.19.7	2025-11-13	3 versions
CVE-2026-72652US	—	0.42% (36th)	—	9.5.2	2026-09-01	3 versions
CVE-2026-72644US	—	0.42% (36th)	—	9.5.2	2026-09-01	3 versions
CVE-2026-33465US	—	0.42% (36th)	—	8.19.21	2026-09-01	3 versions
CVE-2026-72674US	—	0.42% (36th)	—	9.5.1	2026-08-13	4 versions
CVE-2026-72667US	—	0.42% (36th)	—	9.5.1	2026-08-13	4 versions
CVE-2026-72659US	—	0.42% (36th)	—	9.4.5	2026-08-13	4 versions
CVE-2026-72651US	—	0.42% (36th)	—	8.19.20	2026-08-13	4 versions
CVE-2026-42397US	—	0.42% (36th)	—	9.4.3	2026-07-21	6 versions
CVE-2026-72629US	—	0.42% (36th)	—	9.3.8	2026-08-13	4 versions
CVE-2024-52974US	—	0.41% (35th)	—	8.15.1	2025-04-08	2 versions

showing 50 of 148

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-863Incorrect Authorization24 CVEs
CWE-770Allocation of Resources Without Limits or Throttling18 CVEs
CWE-862Missing Authorization18 CVEs
CWE-400Uncontrolled Resource Consumption11 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')10 CVEs
CWE-639Authorization Bypass Through User-Controlled Key8 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')6 CVEs
CWE-918Server-Side Request Forgery (SSRF)6 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)148 CVEs
NLNCSC-NL (CSAF)5 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan