CVE-2025-12978 CVE-2025-12978

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins contain a flaw in the tagkey validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed acces...

CVE-2025-12978 CVE-2025-12978

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins contain a flaw in the tagkey validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed acces...

CVE-2025-12977 CVE-2025-12977

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins fail to sanitize tagkey inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tagkey values containing special characters such as newlines or ../ that are treated as valid tags...

CVE-2025-12977 CVE-2025-12977

Fluent Bit inhttp, insplunk, and inelasticsearch input plugins fail to sanitize tagkey inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tagkey values containing special characters such as newlines or ../ that are treated as valid tags...

CVE-2025-12977

Fluent Bit vulnerability CVE-2025-12977 affects the in_http, in_splunk, and in_elasticsearch input plugins. The root cause is improper sanitization of tag_key inputs, allowing special characters (e.g., newlines, ../) to be treated as valid tags. This can lead to newline injection, path traversal,...

EUVD-2025-198765

Malicious code in @trigo/atrix-elasticsearch npm...

Malicious code in @trigo/atrix-elasticsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0126e7ed19553bfe7d77922b8f8f506539820240400ca6a89a6d0fa4c657b7bb The package @trigo/atrix-elasticsearch was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190759 Malicious code in @trigo/atrix-elasticsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0126e7ed19553bfe7d77922b8f8f506539820240400ca6a89a6d0fa4c657b7bb The package @trigo/atrix-elasticsearch was found to contain malicious code. Source: ghsa-malware...

PT-2025-47923

Name of the Vulnerable Software and Affected Versions Fluent Bit versions affected versions not specified Description The in http, in splunk, and in elasticsearch input plugins in Fluent Bit do not properly sanitize tag key inputs. An attacker who can access the network or write records to Splunk...

CVE-2025-37727 vulnerabilities

Vulnerabilities for packages: ruby3.4-elasticsearch, ruby3.3-elasticsearch, ruby3.2-elasticsearch...

GHSA-56R7-H6MW-RCFV vulnerabilities

Vulnerabilities for packages: ruby3.4-elasticsearch, ruby3.3-elasticsearch, ruby3.2-elasticsearch...

GHSA-56R7-H6MW-RCFV vulnerabilities

Vulnerabilities for packages: ruby3.2-elasticsearch, conductor-fips, elasticsearch-fips, ruby3.4-elasticsearch, conductor, ruby3.3-elasticsearch...

CVE-2025-37727 vulnerabilities

Vulnerabilities for packages: ruby3.2-elasticsearch, conductor-fips, elasticsearch-fips, ruby3.4-elasticsearch, conductor, ruby3.3-elasticsearch...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: scorecard, harbor-registry-fips, git-credential-oauth, wavefront-collector-for-kubernetes, openbao-k8s-fips, configmap-reload, spicedb-operator-fips, wgcf, nvidia-nsight-compute-12.8, crossplane-function-go-templating-fips, mkcert, xeol-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: scorecard, harbor-registry-fips, git-credential-oauth, wavefront-collector-for-kubernetes, openbao-k8s-fips, configmap-reload, spicedb-operator-fips, wgcf, nvidia-nsight-compute-12.8, crossplane-function-go-templating-fips, mkcert, xeol-fips,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: scorecard, harbor-registry-fips, git-credential-oauth, wavefront-collector-for-kubernetes, openbao-k8s-fips, configmap-reload, spicedb-operator-fips, wgcf, nvidia-nsight-compute-12.8, crossplane-function-go-templating-fips, mkcert, xeol-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: scorecard, harbor-registry-fips, git-credential-oauth, wavefront-collector-for-kubernetes, openbao-k8s-fips, configmap-reload, spicedb-operator-fips, wgcf, nvidia-nsight-compute-12.8, crossplane-function-go-templating-fips, mkcert, xeol-fips,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: scorecard, harbor-registry-fips, git-credential-oauth, wavefront-collector-for-kubernetes, openbao-k8s-fips, configmap-reload, spicedb-operator-fips, wgcf, nvidia-nsight-compute-12.8, crossplane-function-go-templating-fips, mkcert, xeol-fips,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: scorecard, harbor-registry-fips, git-credential-oauth, wavefront-collector-for-kubernetes, openbao-k8s-fips, configmap-reload, spicedb-operator-fips, wgcf, nvidia-nsight-compute-12.8, crossplane-function-go-templating-fips, mkcert, xeol-fips,...

Linux Distros Unpatched Vulnerability : CVE-2025-37727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the...