[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f52bIPnfZSeQ8JJHYAz-7Qct5NLedrWDWSwwJ-5AlW0s":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":149,"kevVulnerabilities":209,"topProductsByCves":219,"seoMetadata":230,"meta":239},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":148},9176,"elastic",30,185,2,2033,"2025-10-10","e",[16,22,28,35,41,47,53,56,60,66,71,76,79,84,87,91,94,98,103,107,111,115,119,124,127,130,133,136,141,144],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":21,"last_cve_update":13},41042,"kibana",472,80,1,{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":21,"last_cve_update":27},41033,"elasticsearch",371,42,"2025-05-01",{"id":29,"product_name":30,"version_count":31,"cve_count":32,"kev_count":33,"last_cve_update":34},41045,"logstash",184,12,0,"2023-11-15",{"id":36,"product_name":37,"version_count":38,"cve_count":39,"kev_count":33,"last_cve_update":40},41049,"x-pack",52,9,"2018-03-30",{"id":42,"product_name":43,"version_count":44,"cve_count":45,"kev_count":33,"last_cve_update":46},41030,"elastic_cloud_enterprise",21,6,"2023-10-26",{"id":48,"product_name":49,"version_count":50,"cve_count":51,"kev_count":33,"last_cve_update":52},41039,"enterprise_search",27,5,"2023-12-12",{"id":54,"product_name":55,"version_count":45,"cve_count":51,"kev_count":33,"last_cve_update":27},41026,"elastic_agent",{"id":57,"product_name":58,"version_count":59,"cve_count":51,"kev_count":33,"last_cve_update":27},41038,"endpoint_security",11,{"id":61,"product_name":62,"version_count":63,"cve_count":64,"kev_count":33,"last_cve_update":65},41024,"apm_server",182,4,"2024-08-03",{"id":67,"product_name":68,"version_count":50,"cve_count":69,"kev_count":33,"last_cve_update":70},41020,"apm_agent",3,"2021-12-08",{"id":72,"product_name":73,"version_count":74,"cve_count":11,"kev_count":33,"last_cve_update":75},41028,"elastic_app_search",15,"2021-05-13",{"id":77,"product_name":78,"version_count":11,"cve_count":11,"kev_count":33,"last_cve_update":52},41029,"elastic_beats",{"id":80,"product_name":81,"version_count":82,"cve_count":11,"kev_count":33,"last_cve_update":83},41044,"kibana_x-pack",43,"2018-09-19",{"id":85,"product_name":86,"version_count":82,"cve_count":11,"kev_count":33,"last_cve_update":83},41034,"elasticsearch_x-pack",{"id":88,"product_name":89,"version_count":90,"cve_count":11,"kev_count":33,"last_cve_update":83},41046,"logstash_x-pack",24,{"id":92,"product_name":93,"version_count":11,"cve_count":11,"kev_count":33,"last_cve_update":46},41031,"elastic_cloud_on_kubernetes",{"id":95,"product_name":96,"version_count":11,"cve_count":11,"kev_count":33,"last_cve_update":97},41036,"endgame","2023-02-08",{"id":99,"product_name":100,"version_count":101,"cve_count":21,"kev_count":33,"last_cve_update":102},41023,"apm_.net_agent",40,"2023-11-22",{"id":104,"product_name":105,"version_count":21,"cve_count":21,"kev_count":33,"last_cve_update":106},41043,"kibana_reporting","2017-06-16",{"id":108,"product_name":109,"version_count":110,"cve_count":21,"kev_count":33,"last_cve_update":102},41022,"apm_java_agent",69,{"id":112,"product_name":113,"version_count":21,"cve_count":21,"kev_count":33,"last_cve_update":114},41047,"network_drive_connector","2024-02-07",{"id":116,"product_name":117,"version_count":20,"cve_count":21,"kev_count":33,"last_cve_update":118},41048,"winlogbeat","2019-03-25",{"id":120,"product_name":121,"version_count":122,"cve_count":21,"kev_count":33,"last_cve_update":123},41021,"apm-agent-ruby",41,"2019-07-30",{"id":125,"product_name":126,"version_count":11,"cve_count":21,"kev_count":33,"last_cve_update":46},41032,"elastic_fleet_server",{"id":128,"product_name":129,"version_count":21,"cve_count":21,"kev_count":33,"last_cve_update":46},41035,"elastic_sharepoint_online_python_connector",{"id":131,"product_name":132,"version_count":11,"cve_count":21,"kev_count":33,"last_cve_update":46},41037,"endpoint",{"id":134,"product_name":135,"version_count":32,"cve_count":21,"kev_count":33,"last_cve_update":83},41025,"azure_repository",{"id":137,"product_name":138,"version_count":139,"cve_count":21,"kev_count":33,"last_cve_update":140},41040,"filebeat",295,"2023-05-04",{"id":142,"product_name":143,"version_count":69,"cve_count":21,"kev_count":33,"last_cve_update":46},41041,"fleet_server",{"id":145,"product_name":146,"version_count":11,"cve_count":33,"kev_count":33,"last_cve_update":147},41027,"elastic_apm_server",null,"Elastic is a technology vendor with 30 tracked products and 185 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[150,158,163,170,177,181,187,193,199,204],{"cveId":151,"description":152,"publishedDate":153,"cvssScore":154,"cvssVersion":155,"severity":156,"isKev":4,"epssScore":157},"CVE-2015-1427","The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.","2015-02-17",9.8,"v3.1","Critical",0.99906,{"cveId":159,"description":160,"publishedDate":118,"cvssScore":161,"cvssVersion":155,"severity":156,"isKev":4,"epssScore":162},"CVE-2019-7609","Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.",10,0.95338,{"cveId":164,"description":165,"publishedDate":166,"cvssScore":154,"cvssVersion":167,"severity":156,"isKev":168,"epssScore":169},"CVE-2018-17246","Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","2018-12-20","v3.0",false,0.82251,{"cveId":171,"description":172,"publishedDate":173,"cvssScore":174,"cvssVersion":155,"severity":175,"isKev":168,"epssScore":176},"CVE-2021-22145","A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.","2021-07-21",6.5,"Medium",0.76249,{"cveId":178,"description":179,"publishedDate":46,"cvssScore":174,"cvssVersion":155,"severity":175,"isKev":168,"epssScore":180},"CVE-2023-31419","A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.",0.61726,{"cveId":182,"description":183,"publishedDate":173,"cvssScore":184,"cvssVersion":155,"severity":185,"isKev":168,"epssScore":186},"CVE-2021-22146","All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.",7.5,"High",0.35781,{"cveId":188,"description":189,"publishedDate":190,"cvssScore":191,"cvssVersion":155,"severity":156,"isKev":168,"epssScore":192},"CVE-2025-25014","A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.","2025-05-06",9.1,0.22347,{"cveId":194,"description":195,"publishedDate":196,"cvssScore":197,"cvssVersion":155,"severity":185,"isKev":168,"epssScore":198},"CVE-2020-7012","Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. An authenticated attacker with privileges to write to the Kibana index could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.","2020-06-03",8.8,0.18211,{"cveId":200,"description":201,"publishedDate":202,"cvssScore":154,"cvssVersion":167,"severity":156,"isKev":168,"epssScore":203},"CVE-2015-5377","Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol.  NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability","2018-03-06",0.14314,{"cveId":205,"description":206,"publishedDate":207,"cvssScore":184,"cvssVersion":155,"severity":185,"isKev":168,"epssScore":208},"CVE-2022-23712","A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.","2022-06-06",0.0755,[210,215],{"cveId":151,"description":152,"publishedDate":153,"cvssScore":154,"cvssVersion":155,"severity":156,"isKev":4,"epssScore":157,"cisaVulnName":211,"cisaDateAdded":212,"cisaShortDescription":213,"cisaRequiredAction":214},"Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability","2022-03-25","The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.","Apply updates per vendor instructions.",{"cveId":159,"description":160,"publishedDate":118,"cvssScore":161,"cvssVersion":155,"severity":156,"isKev":4,"epssScore":162,"cisaVulnName":216,"cisaDateAdded":217,"cisaShortDescription":218,"cisaRequiredAction":214},"Kibana Arbitrary Code Execution","2022-01-10","Kibana contain an arbitrary code execution flaw in the Timelion visualizer.",[220,221,222,223,224,225,226,227,228,229],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":21,"last_cve_update":13},{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":21,"last_cve_update":27},{"id":29,"product_name":30,"version_count":31,"cve_count":32,"kev_count":33,"last_cve_update":34},{"id":36,"product_name":37,"version_count":38,"cve_count":39,"kev_count":33,"last_cve_update":40},{"id":42,"product_name":43,"version_count":44,"cve_count":45,"kev_count":33,"last_cve_update":46},{"id":48,"product_name":49,"version_count":50,"cve_count":51,"kev_count":33,"last_cve_update":52},{"id":54,"product_name":55,"version_count":45,"cve_count":51,"kev_count":33,"last_cve_update":27},{"id":57,"product_name":58,"version_count":59,"cve_count":51,"kev_count":33,"last_cve_update":27},{"id":61,"product_name":62,"version_count":63,"cve_count":64,"kev_count":33,"last_cve_update":65},{"id":67,"product_name":68,"version_count":50,"cve_count":69,"kev_count":33,"last_cve_update":70},{"title":231,"metaDescription":232,"keywords":233,"structuredData":234},"Elastic - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Elastic covering 30 products with 185 tracked vulnerabilities including 2 critical and 0 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Elastic vulnerabilities, Elastic security, Elastic CVE, Elastic threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Elastic KEV, Elastic exploited vulnerabilities",{"@context":235,"@type":236,"name":237,"description":232,"url":238},"https:\u002F\u002Fschema.org","Organization","Elastic","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Felastic",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":240,"apiVersion":241},"2026-10-17T10:40:31.527Z","3.0"]