PT-2026-54769

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An authenticated user can trigger a denial of service by submitting a specially crafted bulk request. This leads to uncontrolled resource consumption through excessive allocation,...

PT-2026-54864

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An issue exists where the allocation of resources lacks limits or throttling. A user with elevated privileges can submit a specially crafted machine learning request that triggers...

PT-2026-54863

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 8.19.17 Elasticsearch versions prior to 9.3.6 Elasticsearch versions prior to 9.4.3 Description An authenticated user can trigger a denial of service by submitting a specially crafted query. This occurs due to...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: drone-fips, minio, prometheus, opentofu, flux-source-controller-fips, kuma, kubescape, nemo, frankenphp-8.2, gitlab-rails-ce, cilium-cli, k3s, cloudbeat, zot, gitlab-kas, etcd-fips, argo-workflows-fips, minio-fips, prometheus-fips, drone, knative-kafka-broker-fips,...

Budibase has nonymous NoSQL operator injection via published-app query templates

Summary enrichContext at packages/server/src/sdk/workspace/queries/queries.ts:121-138 substitutes parameter values into the raw JSON body of a query, then JSON.parses the result. The validator validateQueryInputs at packages/server/src/api/controllers/query/index.ts:61-71 rejects only Handlebars...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-6733 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

ROOT-APP-MAVEN-CVE-2025-37727 CVE-2025-37727 in io.root.org.elasticsearch:elasticsearch - Patched by Root

Root has patched CVE-2025-37727 in the io.root.org.elasticsearch:elasticsearch package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-37731 CVE-2025-37731 in io.root.org.elasticsearch:elasticsearch - Patched by Root

Root has patched CVE-2025-37731 in the io.root.org.elasticsearch:elasticsearch package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-68390 CVE-2025-68390 in io.root.org.elasticsearch.plugin:x-pack-core - Patched by Root

Root has patched CVE-2025-68390 in the io.root.org.elasticsearch.plugin:x-pack-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-68384 CVE-2025-68384 in io.root.org.elasticsearch.plugin:x-pack-security - Patched by Root

Root has patched CVE-2025-68384 in the io.root.org.elasticsearch.plugin:x-pack-security package for Root:Maven. Multiple fixed versions available...

GHSA-C653-97M9-RCG9 vulnerabilities

Vulnerabilities for packages: apache-pulsar, kafbat-ui, elasticsearch, spark-kubernetes-operator-fips, hadoop-fips, seata, celeborn, commercial-elasticsearch, opensearch, knative-kafka-broker, elasticsearch-fips, request-9047-keycloak-fips, kayenta-fips, spark, thingsboard, kayenta, tinkerpop,...

CVE-2026-50010 vulnerabilities

Vulnerabilities for packages: apache-pulsar, kafbat-ui, elasticsearch, spark-kubernetes-operator-fips, hadoop-fips, seata, celeborn, commercial-elasticsearch, opensearch, knative-kafka-broker, elasticsearch-fips, request-9047-keycloak-fips, kayenta-fips, spark, thingsboard, kayenta, tinkerpop,...

EUVD-2026-36796

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

CVE-2026-47835

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

CVE-2026-47835

In Spring AI Vector Stores, the vulnerability arises from improper handling of special characters that could lead to arbitrary query execution in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components are spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfi...

CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

PT-2026-49305

Name of the Vulnerable Software and Affected Versions Spring AI versions prior to 1.0.9 Spring AI versions prior to 1.1.8 Description Special characters can be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. This issue affects the...

cve-2026-47835 - HIGH - Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

cve-2026-47835 - HIGH - Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores...