108 matches found
CVE-2026-72631
Kibana Fleet vulnerability CVE-2026-72631: Improper Privilege Management can allow an Elastic Agent API key issued to agents in a policy to gain additional write rights (insert new documents and extend index mappings) for certain indices by including extra data streams in the integration policy. ...
CVE-2026-72666
Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...
Kibana 9.4.5, 9.5.1 Security Update (ESA-2026-128)
Improper Privilege Management in Kibana Fleet Leading to Over-Scoped Elastic Agent API Keys Description: Improper Privilege Management CWE-269 in Kibana Fleet can lead to privilege escalation via Privilege Escalation CAPEC-233. An integration policy may optionally declare extra data streams that...
GHSA-259R-337F-4RFW vulnerabilities
Vulnerabilities for packages: reports-server, cilium, snyk-cli, k3s, minio, omnictl-multiarch, nerdctl, loki, commercial-expanso-edge, kine, telegraf, k3d, flux, terraform, cert-manager, zitadel, containerd, prometheus, kyverno, aactl, backup-restore-operator, prometheus-mongodb-exporter,...
GHSA-PJV4-3C63-699F vulnerabilities
Vulnerabilities for packages: elastic-agent, elastic-agent-fips...
CVE-2026-42602 vulnerabilities
Vulnerabilities for packages: elastic-agent, elastic-agent-fips...
GHSA-HJ4R-2C9C-29H3 vulnerabilities
Vulnerabilities for packages: apm-server, cloudbeat-fips, cloudbeat, elastic-agent-fips, apm-server-fips, elastic-agent...
CVE-2023-49922 vulnerabilities
Vulnerabilities for packages: apm-server, cloudbeat-fips, cloudbeat, elastic-agent-fips, apm-server-fips, elastic-agent...
CVE-2026-48496 vulnerabilities
Vulnerabilities for packages: elastic-agent, elastic-agent-fips...
GHSA-F2R5-5M7W-P5CX vulnerabilities
Vulnerabilities for packages: elastic-agent, elastic-agent-fips...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: reports-server, knative-kafka-broker, k3s, cloudbeat, commercial-expanso-edge, external-dns, keda-fips, frankenphp-8.3, gitlab-kas, terraform, chisel-fips, external-secrets-operator-fips, grafana, etcd-fips, kyverno-fips, argocd-image-updater, flux-source-controller,...
CVE-2026-32952 vulnerabilities
Vulnerabilities for packages: k6, cert-manager-istio-csr, cloudbeat, juicefs, kyverno-notation-aws, cert-manager-fips, terraform, agentbeat, spqr, external-secrets-operator-fips, grafana, kyverno-fips, kyverno-notation-aws-fips, cert-manager-csi-driver, syncthing, flux-source-controller,...
CVE-2026-33817 vulnerabilities
Vulnerabilities for packages: rke2-runtime-fips, k3s, fuse-overlayfs-snapshotter, cloudbeat, loki, commercial-expanso-edge, consul, frankenphp-8.3, vault, datadog-agent, zot, beats-fips, cloudbeat-fips, mattermost, kine, consul-fips, vault-fips, beats, containerd, grafana, rke2-runtime,...
GHSA-6JWV-W5XF-7J27 vulnerabilities
Vulnerabilities for packages: rke2-runtime-fips, k3s, fuse-overlayfs-snapshotter, cloudbeat, loki, commercial-expanso-edge, consul, frankenphp-8.3, vault, datadog-agent, zot, beats-fips, cloudbeat-fips, mattermost, kine, consul-fips, vault-fips, beats, containerd, grafana, rke2-runtime,...
CVE-2026-32287 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-memorydb-fips, aws-otel-collector, crossplane-provider-aws-ecs-fips, crossplane-provider-aws-wafv2, crossplane-provider-aws-kinesis-fips, crossplane-provider-aws-sns-fips, crossplane-provider-family-azure, crossplane-provider-aws-backup-fips,...
GHSA-65XW-VW82-R86X vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-memorydb-fips, aws-otel-collector, crossplane-provider-aws-ecs-fips, crossplane-provider-aws-wafv2, crossplane-provider-aws-kinesis-fips, crossplane-provider-aws-sns-fips, crossplane-provider-family-azure, crossplane-provider-aws-backup-fips,...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: json-exporter, terraform-provider-azapi-fips, prometheus-alertmanager-fips, hubble-ui-backend-fips, mongodb-kubernetes-operator-fips, pulumi-language-java, chronyexporter, crossplane-provider-aws-memorydb-fips, oras-fips, yunikorn-web-fips, boring-registry,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: json-exporter, terraform-provider-azapi-fips, prometheus-alertmanager-fips, hubble-ui-backend-fips, pulumi-language-java, chronyexporter, crossplane-provider-aws-memorydb-fips, boring-registry, knative-operator-fips, azure-aad-pod-identity-mic, cloudbeat,...
CVE-2025-11065 vulnerabilities
Vulnerabilities for packages: boring-registry-fips, rancher-security-scan, jitsucom-bulker, beats-fips, docker-compose-fips, istio-fips, zitadel, beats, bank-vaults, pluto-fips, gitlab-cng, grafana, kyverno-notation-aws-fips, kyverno, tkn-fips, grafana-fips, ratify-fips, gitlab-cng-fips,...