GHSA-2MJ3-6GRC-PX38 vulnerabilities

Vulnerabilities for packages: apm-server, beats-fips, cloudbeat-fips, cloudbeat, apm-server-fips, elastic-agent...

CVE-2025-68383 vulnerabilities

Vulnerabilities for packages: apm-server, beats-fips, cloudbeat-fips, cloudbeat, apm-server-fips, elastic-agent...

GHSA-FJ69-23M4-CCVV vulnerabilities

Vulnerabilities for packages: apm-server, cloudbeat-fips, cloudbeat, elastic-agent-fips, apm-server-fips, elastic-agent...

CVE-2025-68388 vulnerabilities

Vulnerabilities for packages: apm-server, cloudbeat-fips, cloudbeat, elastic-agent-fips, apm-server-fips, elastic-agent...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: op-geth, hubble-ui-backend-fips, mongodb-kubernetes-operator-fips, oras-fips, yunikorn-web-fips, boring-registry, sigstore-scaffolding-fips, knative-operator-fips, cloudbeat, gcp-compute-persistent-disk-csi-driver-fips, external-dns, flannel-cni-plugin-fips,...

EUVD-2023-3224

Malicious code in bioql PyPI...

EUVD-2023-58908

Malicious code in bioql PyPI...

EUVD-2023-50860

Malicious code in bioql PyPI...

EUVD-2025-13061

Malicious code in bioql PyPI...

EUVD-2024-36558

Malicious code in bioql PyPI...

EUVD-2024-40289

Malicious code in bioql PyPI...

CVE-2024-37283

An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs...

CVE-2023-46669

Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was identified by Elastic engineers and Elastic has no indication that it is known or ha...

CVE-2024-52976

Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osqueryd configurations...

CVE-2024-52976

Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osqueryd configurations...

Inclusion of Functionality from Untrusted Control Sphere

Overview github.com/elastic/elastic-agent is an a single, unified way to add monitoring for logs, metrics, and other types of data to a host. Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere via parameter injection in the osqueryd...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview github.com/elastic/elastic-agent/internal/pkg/agent/application is a single, unified way to add monitoring for logs, metrics, and other types of data to a host Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere d...

CVE-2023-46669

Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was identified by Elastic engineers and Elastic has no indication that it is known or ha...

CVE-2024-52976 Elastic Agent Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection. An attacker requires local access and the ability to modify osqueryd configurations...

CVE-2024-52976

CVE-2024-52976 concerns Elastic Agent (and related Beats/Elastic-Agent components) where functionality from an untrusted control sphere in the osqueryd subprocess allows local attackers to execute arbitrary code via parameter injection. Affected versions include Elastic Agent up to 7.17.24 and 8....