CVE-2025-26478

Dell ECS version 3.8.1.4 and prior contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2025-25013

Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack...

CVE-2025-25013

Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack...

CVE-2025-25013

CVE-2025-25013 affects Elastic Defend; the issue is improper restriction of environment variables, causing exposure of sensitive data (e.g., API keys/tokens) via unfiltered env vars transmitted to the stack. Reported CVSSv3.1: 6.5 (Medium), with network attack vector, low attack complexity, low p...

CVE-2025-25013 Elastic Defend Insertion of Sensitive Information into Log Files

Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack...

CVE-2025-25013 Elastic Defend Insertion of Sensitive Information into Log Files

Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack...

Elastic Defend 8.17.3 Security Update (ESA-2025-05)

Elastic Defend Insertion of Sensitive Information into Log Files ESA-2025-05 Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmission of unfiltered environment variables to the stack. This...

Elastic Defend 日志信息泄露漏洞

Elastic Defend is an application from the Dutch company Elastic. It provides prevention, detection and response capabilities, as well as deep visibility into EPP, EDR, SIEM and security analytics. A log information disclosure vulnerability exists in Elastic Defend versions prior to 8.17.3, which...

Elastic Kibana 资源管理错误漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic, Inc. A resource management error vulnerability exists in Elastic Kibana versions 7.17.0 through 7.17.22 and 8.0.0 through 8.15.0, which stems from a flaw in the handling of ad-hoc requests to the Observability API...

PT-2025-15665 · Elastic · Defend

Name of the Vulnerable Software and Affected Versions: Elastic Defend affected versions not specified Description: The issue is related to the improper restriction of environment variables in Elastic Defend, which can lead to the exposure of sensitive information such as API keys and tokens. This...

Elastic Kibana 安全漏洞

Elastic Kibana is a usable data visualization dashboard software from Elastic. A security vulnerability exists in Elastic Kibana versions 8.16.1 and earlier and 8.17.1, which stems from prototype contamination combined with unrestricted file uploads and path traversal, which could lead to code...

Citrix App Layering 2409 - Unable to Edit App Layers with Boot Error 0xc000000f

Administrators may encounter an issue where they are unable to edit Application Layers within Citrix Elastic Layer Management ELM version 2409 after applying the February 2025 patches to their Windows 11 24H2 packaging machines. This inability to edit App Layers is accompanied by aboot error code...

CVE-2024-10190 Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod

Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandler. Specifically, the putvalue method in ElasticRendezvousHandler...

CVE-2025-29786 vulnerabilities

Vulnerabilities for packages: kargo, splunk-otel-collector-fips, opentelemetry-collector-fips, grafana-alloy, grafana-alloy-fips, keda, argo-cd, argo-workflows-fips, opentelemetry-collector-contrib, eks-distro-fips, opentelemetry-collector, eks-distro, amazon-cloudwatch-agent,...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: kargo, splunk-otel-collector-fips, opentelemetry-collector-fips, grafana-alloy, grafana-alloy-fips, keda, argo-cd, argo-workflows-fips, opentelemetry-collector-contrib, eks-distro-fips, opentelemetry-collector, eks-distro, amazon-cloudwatch-agent,...

Elastic Releases Urgent Fix for Critical Kibana Vulnerability Enabling Remote Code Execution

Elastic has rolled out security updates to address a critical security flaw impacting the Kibana data visualization dashboard software for Elasticsearch that could result in arbitrary code execution. The vulnerability, tracked as CVE-2025-25015 , carries a CVSS score of 9.9 out of a maximum of...

CVE-2024-10925

A vulnerability in GitLab-EE affecting all versions from 16.2 prior to 17.7.6, 17.8 prior to 17.8.4, and 17.9 prior to 17.9.1 allows a Guest user to read Security policy YAML...

Elastic Kibana 安全漏洞

Elastic Kibana is an available data visualization dashboard software from Elastic, Inc. A security vulnerability exists in Elastic Kibana versions 8.15.0 through 8.17.1 and 8.17.1 through 8.17.2, which stems from prototype contamination that could lead to the execution of arbitrary code...

AWS VDP: Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The DocumentDB Elastic service was found to have three non-production API endpoints that could be accessed using standard IAM credentials without logging to CloudTrail. This allowed for silent permission enumeration, where an adversary could determine the permissions of compromised credentials...

Malicious code in elastic-buildkite-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 889d976fe581d0e221dc91fb52cc010669d68189ba293e437a6966b6decd515f The OpenSSF Package Analysis project identified 'elastic-buildkite-manager' @ 2.0.0 npm as malicious. It is considered malicious because: - The...