CVE-2022-38777

An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to those of the LocalSystem account...

CVE-2020-7010

Elastic Cloud on Kubernetes ECK versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK...

CVE-2020-7018

Elastic Enterprise Search before 7.9.0 contain a credential exposure flaw in the App Search interface. If a user is given the �developer� role, they will be able to view the administrator API credentials. These credentials could allow the developer user to conduct operations with the same...

coldsnap (>=0.4.0 <=0.5.1) potentially affected by unknown CVE via aws-sdk-ebs (>=0.16.0 <=0.24.0)

aws-sdk-ebs CARGO version =0.16.0, =0.4.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-G59M-GF8J-GJF5...

aws-sg-cleanup (>=0.1.0 <=0.1.3), ec2-search (>=0.14.0 <=0.14.1) potentially affected by unknown CVE via aws-sdk-elasticloadbalancingv2 (>=0.15.0 <=0.9.0)

aws-sdk-elasticloadbalancingv2 CARGO version =0.15.0, =0.1.0, =0.14.0, =0.14.1 Source cves: unknown CVE Source advisory: OSV:GHSA-G59M-GF8J-GJF5...

CVE-2019-7618

A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary files from the local filesystem of the Kibana instance running Code with the permission of the Kibana system user...

Malicious Package

Overview elastic-docs-v3-utilities is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in elastic-docs-v3-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3812db2733b6d6bfaba2e5b7b08065e1b07291a2a58a6dfa589b31added3e6 The package elastic-docs-v3-utilities was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-1105

Malicious code in elastic-docs-v3-utilities npm...

MAL-2026-85 Malicious code in elastic-docs-v3-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3812db2733b6d6bfaba2e5b7b08065e1b07291a2a58a6dfa589b31added3e6 The package elastic-docs-v3-utilities was found to contain malicious code. Source: ghsa-malware...

CVE-2023-54201 RDMA/efa: Fix wrong resources deallocation order

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request the device to destroy the object. If t...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an RDMA efa resource release in the wrong order, which could lead to reuse after release...

GHSA-2MJ3-6GRC-PX38 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, elastic-agent, cloudbeat, cloudbeat-fips, beats-fips...

CVE-2025-68383 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, elastic-agent, cloudbeat, cloudbeat-fips, beats-fips...

CVE-2025-68388 vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, elastic-agent, cloudbeat, cloudbeat-fips, elastic-agent-fips...

GHSA-FJ69-23M4-CCVV vulnerabilities

Vulnerabilities for packages: apm-server-fips, apm-server, elastic-agent, cloudbeat, cloudbeat-fips, elastic-agent-fips...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the processing of malicious IPv4 fragments. An attacker can exhaust system memory and CPU resources by sending specially crafted network packets. Remediation Upgrade...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the Syslog parser or the Dissect configuration processor. An attacker can cause a denial of service by sending a malformed Syslog message or crafting a malicious tokenizer pattern...

Allocation of Resources Without Limits or Throttling

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling during the handling of HTTP requests. An attacker can exhaust computing...

Elastic Kibana 安全漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic. A security vulnerability exists in Elastic Kibana that stems from improper input neutralization and could lead to a cross-site scripting attack...