Kibana - Local File Inclusion

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

BIT-KIBANA-2026-63260 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this...

CVE-2026-13676 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, kibana...

GHSA-4C8G-83QW-93J6 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, kibana...

GHSA-V245-V573-V5VM vulnerabilities

Vulnerabilities for packages: kibana, gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-59887 vulnerabilities

Vulnerabilities for packages: kibana, gitlab-rails-ce-fips, gitlab-rails-ce...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, librechat, kibana, opensearch-dashboards, langfuse, langfuse-fips, nextcloud-server...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, librechat, kibana, langfuse, langfuse-fips, nextcloud-server...

GHSA-45RX-2JWX-CXFR vulnerabilities

Vulnerabilities for packages: kibana...

CVE-2026-59892 vulnerabilities

Vulnerabilities for packages: kibana...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, librechat, kibana, opensearch-dashboards, langfuse, opensearch-dashboards-fips, langfuse-fips, nextcloud-server...

CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, librechat, kibana, langfuse, langfuse-fips, nextcloud-server...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, librechat, kibana, opensearch-dashboards, langfuse, opensearch-dashboards-fips, langfuse-fips, nextcloud-server...

CVE-2026-65901 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, librechat, kibana, langfuse, langfuse-fips, nextcloud-server...

GHSA-8R6M-32JQ-JX6Q vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, kibana, tileserver-gl, langfuse, thingsboard-fips, langfuse-fips...

Kibana Timelion - Arbitrary Code Execution

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands...

EUVD-2026-47590

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

EUVD-2026-47578

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

EUVD-2026-47580

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

EUVD-2026-47589

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...