Top technology
Linux 13140
Google 12536
Microsoft 12379
Oracle 6843
Apple 6692
Adobe 6387
Ibm 6336
Cisco 5759
Debian 3919
Mozilla 2895
Apache 2864
Redhat 2592
Linux 13140
Google 12536
Microsoft 12379
Oracle 6843
Apple 6692
Adobe 6387
Ibm 6336
Cisco 5759
Debian 3919
Mozilla 2895
Apache 2864
Redhat 2592
HIGH 7.6
CVE-2026-72669
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update …
No fix yet
MEDIUM 6.5
CVE-2026-72667
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A spec…
No fix yet
MEDIUM 6.8
CVE-2026-72666
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigne…
No fix yet
HIGH 8.1
CVE-2026-72665
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Acce…
No fix yet
MEDIUM 6.5
CVE-2026-72664
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functi…
No fix yet
MEDIUM 6.5
CVE-2026-72663
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, de…
No fix yet
MEDIUM 6.5
CVE-2026-72661
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). …
No fix yet
MEDIUM 6.5
CVE-2026-72660
Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation …
No fix yet
MEDIUM 6.5
CVE-2026-72659
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specia…
No fix yet
HIGH 7.3
CVE-2026-72658
Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to…
No fix yet
MEDIUM 6.5
CVE-2026-72657
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variab…
No fix yet
MEDIUM 6.5
CVE-2026-72656
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allo…
No fix yet
MEDIUM 6.5
CVE-2026-72653
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authe…
No fix yet
MEDIUM 6.5
CVE-2026-72651
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authe…
No fix yet
MEDIUM 6.5
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosu…
No fix yet
MEDIUM 6.5
CVE-2026-72647
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticate…
No fix yet
MEDIUM 6.5
CVE-2026-72645
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authent…
No fix yet
HIGH 7.1
CVE-2026-72643
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to…
No fix yet
HIGH 8.8
CVE-2026-72642
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory ad…
No fix yet
MEDIUM 6.5
CVE-2026-72640
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespa…
No fix yet
MEDIUM 6.5
CVE-2026-72639
Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that…
No fix yet
MEDIUM 6.5
CVE-2026-72638
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holdin…
No fix yet
MEDIUM 6.5
CVE-2026-72636
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). …
No fix yet
HIGH 7.1
CVE-2026-72632
Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API k…
No fix yet
MEDIUM 6.5
CVE-2026-72631
Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy …
No fix yet
HIGH 7.1
CVE-2026-72630
Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to m…
No fix yet
HIGH 7.1
CVE-2026-72629
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Prop…
No fix yet
HIGH 7.1
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite …
Patch available
HIGH 8.6
CVE-2026-49864
wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download …
No fix yet
MEDIUM 6.5
CVE-2026-49089
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query …
No fix yet