Kibana 9.3.x < 9.3.7 / 9.4.x < 9.4.4 DoS (ESA-2026-55)

The version of Kibana installed on the remote host is 9.3.x prior to 9.3.7 or 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-55 advisory. - Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via...

CVE-2026-42397

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-42397 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive...

CVE-2026-42397

Kibana is affected by CVE-2026-42397 through a vulnerability in Entity Analytics endpoints where authenticated users can submit oversized input, causing excessive resource consumption and potential denial of service (CWE-770; CAPEC-130). Affected versions include 9.x (9.3.0–9.3.6 and 9.4.0–9.4.3)...

PT-2026-62076

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted request to Entity Analytics endpoints. By providing an oversized input value, the attacker can trigger...

CVE-2025-60427

LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls. The backend does not verify role-based permissions for analytics endpoints, allowing unauthorized retrieval of...

CVE-2025-25014 Kibana arbitrary code execution via prototype pollution

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints...