134
CVEs
3
Critical
28
High
0
KEV
2
PoC
27
Unpatched C/H
9.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
28
MEDIUM
100
LOW
3
Monthly CVE Trend
Affected Products (30)
Kibana
166
Elasticsearch
77
Cloud Foundry Elastic Runtime
23
Elastic Services Controller
19
Logstash
13
Java
11
Cloud Foundry Uaa
11
Open Redirect
10
Redis
9
Peoplesoft Enterprise Peopletools
9
Amazon
9
X Pack
9
Python
8
Elastic Cloud Enterprise
8
Cf Release
8
Kubernetes
8
Cloud Foundry
7
Elastic Agent
6
Cloud Foundry Uaa Bosh
6
Elastic Storage Server
6
Cloud Foundry Ops Manager
5
Enterprise Search
5
Opensearch
5
Fleet Server
5
Openshift Container Platform
5
Node.js
4
Docker
4
Communications Cloud Native Core Automated Test Suite
4
Apm Server
4
Eck Operator
4
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-54511 | Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream collectors such as rsyslog, Splunk, and Elastic Stack. The escapeStructuredDataValue() function omits C0 control character escaping, so a literal newline embedded in a log property value terminates the current RFC 6587 TCP syslog frame and begins a new one; if the attacker-supplied bytes constitute a valid RFC 5424 header, the downstream collector accepts them as a separate, authentic-looking record. A second injection path exists through unvalidated SD-NAME keys, which can prematurely close structured-data elements. Both paths require the non-default SyslogSinkOptions.includeStructuredData: true setting. Publicly available proof-of-concept code exists; no CISA KEV listing at time of analysis. | HIGH | 8.6 | 0.3% | 63 |
PoC
|
| CVE-2026-89261 | Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through version 6.2) allows any remote attacker to wipe, restructure, or poison the platform's blog search index. The ElasticSearchRestApi controller exposes POST operations - index initialization, bulk delete, single-document delete, and arbitrary entry injection - without any authentication gate in WebSecurityConfig. Four distinct proof-of-concept Python scripts are publicly available on GitHub, scripting each attack path and significantly lowering the exploitation barrier. | MEDIUM | 6.9 | 0.5% | 54 |
PoC
No patch
|
| CVE-2026-54350 | Unauthenticated NoSQL operator injection in Budibase server <= 3.39.0 allows anonymous attackers to read or modify all documents in any MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body datasource when a builder has published a query with a PUBLIC role. By injecting JSON metacharacters through query parameters, an attacker can override the intended filter, bypass authentication, and exfiltrate sensitive data or mass-update records in a single HTTP request. Exploit code is publicly available, though no active exploitation is confirmed, and the vulnerability has been patched in version 3.39.12. | CRITICAL | 9.8 | 0.4% | 49 |
|
| CVE-2026-73579 | We need answer JSON only. Need analyze. Need ensure every field string. data_quality_flags array of objects maybe empty. Need extract. Let's inspect input. CVE-2026-73579 Apache Syncope incorrect authorization. Description. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-863. Tags: Authentication Bypass, Apache, Elastic. SSVC exploitation none automatable yes technical impact total. ENISA. References lists advisory. Need product_name 1-3 words: Apache Syncope. summary original. technical_context. risk_assessment. affected_products. remediation. exploit_scenario. exploitation_conditions. attack_chain. confidence_notes. data_quality_flags. prevalence. prevalence_basis. assessed_cvss_vector. assessed_cvss40_vector. Need be careful: "Reported by security@apache.org". Tags include Elastic maybe because search backend? Authentication Bypass. Need use all data. KEV not present, POC not explicit. Need not mention POC as public. EPSS not provided. Could say EPSS not available. CVSS provided NVD? but references nvd none? We can reference. Need assess CVSS ourselves. Description says incorrect authorization: non-recursive search requests possible Realms filter rendered empty, voiding restrictions on requester privileges. This is an authorization bypass allowing search results beyond permissions. CVSS from input 9.8: AV:N AC:L PR:N UI:N. But is it truly PR:N? Description says "requester's permissions" maybe authenticated user? Search requests likely authenticated? Let's investigate. Apache Syncope is identity management. Any search requests are transformed... Realms filter ensures results matching requester's permissions. For non-recursive search requests possible filter empty. Attack vector network. Does exploit require authentication? If any requester? Incorrect authorization could be authenticated low privilege. But input CVSS has PR:N. We must not contradict maybe assess. Need "CVSS vector (attack vector, complexity, privileges)" compare. We can note CVSS says unauthent | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-72649 | Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deployment privileges to execute arbitrary attacker-controlled logic on the Elasticsearch host node by supplying a crafted trained model artifact. The flaw stems from unsafe deserialization (CWE-502) of model artifact data during the ML inference loading process, granting the attacker a broader OS system-call surface than the ML subsystem is intended to expose. Elastic has released fixed versions 8.19.2, 9.4.5, and 9.5.1 via ESA-2026-114; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.6% | 45 |
No patch
|
| CVE-2026-72642 | Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by any user holding the low-privilege ML model upload and deploy permission. By crafting a model that embeds an operation computing a memory address from an attacker-controlled offset, a low-privileged authenticated user can cause the native inference subprocess to read and write outside its allocated heap, reliably crashing that process or, under controlled heap layout conditions, executing arbitrary code within it. No active exploitation or public proof-of-concept has been identified at time of analysis, but the CVSS 8.8 rating, network-accessible vector, and explicit RCE potential in the vendor description place this in the urgent-remediation tier for any organization running Elasticsearch with ML features delegated to non-admin users. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-72681 | Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privileged users to create and execute Agent tools that invoke Kibana features they are not authorized to access, bypassing the platform's feature-level access controls. The Agent Builder omits authorization verification against the target feature's required privilege set before tool creation and execution, enabling cross-feature privilege escalation and potential disclosure of sensitive data. No public exploit code exists and EPSS is 0.25%, but SSVC rates technical impact as total, making this a meaningful risk in multi-tenant or role-segmented Kibana deployments. | HIGH | 8.8 | 0.3% | 44 |
No patch
|
| CVE-2026-54320 | Authentication bypass in Daytona prior to 0.184.0 allows attackers to join organizations via pending invitations using unverified email addresses. The invitation accept and decline paths failed to enforce email verification (unlike organization creation), so on OIDC identity providers permitting self-service signup with pre-verification sessions, an attacker registering an email matching a pending invite can claim it and inherit the assigned role - up to Owner. No public exploit identified at time of analysis, but the path to full Owner-level organization takeover makes this a high-priority fix. | HIGH | 8.4 | 0.2% | 42 |
|
| CVE-2026-90772 | Stored cross-site scripting in Amundsen Frontend through 4.3.0 allows authenticated users with description-write access to inject arbitrary JavaScript into table, dashboard, and feature description fields, executing attacker-controlled code in the browser of every user who subsequently views search results. The root cause is React's dangerouslySetInnerHTML used without any HTML sanitization in ResourceListItem components (TableListItem and siblings), meaning payloads such as img elements with onerror handlers stored via the metadata service or Elasticsearch persist and fire on each page load. No public exploit code has been identified at time of analysis, but the attack pattern is elementary for anyone with metadata write access. | HIGH | 8.3 | 0.2% | 42 |
No patch
|
| CVE-2026-63137 | Privilege escalation in Kibana allows an authenticated user holding workflow edit permissions to cause scheduled workflow executions to run under the privileges of a higher-privileged user, granting unauthorized read and write access to data outside their authorization scope. The flaw (CWE-863, Incorrect Authorization) stems from Kibana's workflow scheduling subsystem failing to enforce authorization boundaries when executing scheduled jobs - a pattern classified under CAPEC-180. No public exploit exists at time of analysis, but the CVSS 8.3 (High) score with a network-accessible, low-privilege attack vector reflects genuine impact for any multi-user Kibana deployment. Elastic's advisory ESA-2026-61 references Kibana 9.4.3 as the fix release. | HIGH | 8.3 | 0.3% | 42 |
No patch
|
| CVE-2026-72665 | Missing Authorization in Kibana's Elastic Security module permits authenticated users holding detection rule authoring privileges to execute Osquery live queries and Elastic Defend response actions against enrolled managed endpoints without possessing the specific Osquery or Elastic Defend privileges that normally govern those capabilities. The CVSS 8.1 score reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against enrolled host infrastructure. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but patch versions 8.19.20 and 9.4.5 are available per Elastic Security Advisory ESA-2026-96. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-78583 | Privilege escalation in Kibana's Fleet management component allows any user holding Fleet management privileges to mint arbitrarily elevated Elasticsearch cluster credentials - up to full cluster administration - for every Elastic Agent enrolled in a targeted policy. Elasticsearch cluster privilege declarations sourced from integration packages were not validated before being used to generate agent credentials (CWE-863: Incorrect Authorization), enabling an attacker to inject overprivileged credentials across an entire agent fleet. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed, but the impact is laterally broad: a single privileged user can compromise all agents and the Elasticsearch cluster they authenticate to. | HIGH | 8.1 | 0.2% | 41 |
No patch
|
| CVE-2026-82302 | Incorrect authorization (CWE-863) in Elastic Kibana allows authenticated users holding only low-privilege accounts to modify configurations that should be restricted to higher-privilege roles, bypassing Kibana's access control enforcement. The CVSS vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N) confirms the flaw is network-exploitable with minimal complexity and yields high confidentiality and integrity impact against Kibana's configuration plane. Elastic has released patched versions across the 8.x and 9.x release trains under advisory ESA-2026-178; no public exploit has been identified and the vulnerability is not listed in CISA KEV. | HIGH | 8.1 | 0.2% | 41 |
No patch
|
| CVE-2026-49091 | Log injection in Elastic Kibana (fixed in 7.17.15 and 8.11.1) allows an attacker with low-privilege access to embed unneutralized control characters in input that Kibana writes verbatim to its log files; when an operator later views those logs in a terminal that interprets ANSI/control sequences, the injected payload can forge, hide, or rewrite displayed log content. The issue is tracked as CWE-117 (Improper Output Neutralization for Logs) and carries a vendor CVSS of 8.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.0 | 0.2% | 40 |
No patch
|
| CVE-2026-61053 | Local privilege escalation to full product takeover in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0) lets a low-privileged attacker with logon access to the host running the ECE infrastructure compromise the Diameter Gateway and SDK component. Per Oracle's CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N), exploitation is authenticated and local but easily performed, yielding high confidentiality, integrity, and availability impact (base 7.8). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV. | HIGH | 7.8 | 0.2% | 39 |
No patch
|