2305 matches found
Improper Input Validation
Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to Elasticsearch control headers lacking the Camel prefix and therefore bypassing Camel's inbound HTTP header filtering, which allows an unauthenticated attacker to inject user-controlled headers and override...
ElasticSearch <1.6.1 - Local File Inclusion
ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. id: CVE-2015-5531 info: name: ElasticSearch 1.6.1 - Local File Inclusion author: princechaddha severity: medium description: ElasticSearch before 1.6.1 allows remote...
ElasticSearch v1.1.1/1.2 RCE
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...
Elasticsearch - Local File Inclusion
Elasticsearch before 1.4.5 and 1.5.x before 1.5.2 allows remote attackers to read arbitrary files via unspecified vectors when a site plugin is enabled. id: CVE-2015-3337 info: name: Elasticsearch - Local File Inclusion author: pdteam severity: medium description: Elasticsearch before 1.4.5 and...
Elasticsearch 7.10.0-7.13.3 - Information Disclosure
ElasticSsarch 7.10.0 to 7.13.3 is susceptible to information disclosure. A user with the ability to submit arbitrary queries can submit a malformed query that results in an error message containing previously used portions of a data buffer. This buffer can contain sensitive information such as...
Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting
Fantastic ElasticSearch WordPress plugin = 4.1.0 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to visit a malicious link. id: CVE-2024-13221 info: name:...
CVE-2026-71848 vulnerabilities
Vulnerabilities for packages: kibana, langfuse, langfuse-fips...
CVE-2026-71849 vulnerabilities
Vulnerabilities for packages: kibana, langfuse, langfuse-fips...
CVE-2026-71850 vulnerabilities
Vulnerabilities for packages: kibana, langfuse, langfuse-fips...
GHSA-PMHH-3W7G-XQP8 vulnerabilities
Vulnerabilities for packages: elasticsearch-fips, apache-tika, spdx-tools-java, elasticsearch, gradle, metabase, jbang, nextflow, apache-hop, apache-hop-fips, conductor, conductor-fips, apache-tika-fips...
CVE-2026-71497 vulnerabilities
Vulnerabilities for packages: elasticsearch-fips, apache-tika, spdx-tools-java, elasticsearch, gradle, metabase, jbang, nextflow, apache-hop, apache-hop-fips, conductor, conductor-fips, apache-tika-fips...
CVE-2026-19111 Insecure direct object reference in Strands Agents Tools memory tool namespace isolation
Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...
Apache Solr <= 7.1 - XML Entity Injection
Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...
GHSA-H663-9FGH-W7XF vulnerabilities
Vulnerabilities for packages: ruby3.4-elasticsearch, ruby3.2-elasticsearch, ruby3.3-elasticsearch, ruby4.0-elasticsearch...
CVE-2026-56144 vulnerabilities
Vulnerabilities for packages: ruby3.4-elasticsearch, ruby3.2-elasticsearch, ruby3.3-elasticsearch, ruby4.0-elasticsearch...
GHSA-727X-48VV-8CJ7 vulnerabilities
Vulnerabilities for packages: ruby3.4-elasticsearch, ruby3.2-elasticsearch, ruby3.3-elasticsearch, ruby4.0-elasticsearch...
CVE-2026-63144 vulnerabilities
Vulnerabilities for packages: ruby3.4-elasticsearch, ruby3.2-elasticsearch, ruby3.3-elasticsearch, ruby4.0-elasticsearch...
CVE-2026-56145 vulnerabilities
Vulnerabilities for packages: ruby3.4-elasticsearch, ruby3.2-elasticsearch, ruby3.3-elasticsearch, ruby4.0-elasticsearch...