Known vulnerabilities in Elasticsearch - page 2

Software: Elasticsearch
Software CPE: cpe:2.3:a:elastic_stack:elasticsearch:*:*:*:*:*:*:*:*
Total vulnerabilities: 70
Public exploits: 5
Known exploited (KEV): 2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Elasticsearch Elasticsearch is affected by 70 known vulnerabilities: 2 high, 26 medium, 42 low Critical High Medium Low

Vulnerabilities (70)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU121007 - Exposure of sensitive information to an unauthorized actor
CVE-2025-66566
CWE-200 Medium
No
No
8.19.10, 9.1.10, 9.2.4 07.01.2026 SB2026010702
SB2026010705
SB2026010706
and 28 more
#VU120208 - Resource exhaustion
CVE-2025-68384
CWE-400 Medium
No
No
8.19.9, 9.1.9, 9.2.3 19.12.2025 SB2025121916
#VU120207 - Resource exhaustion
CVE-2025-68390
CWE-400 Low
No
No
8.19.8, 9.1.8, 9.2.2 19.12.2025 SB2025121524
SB2026041730
SB2026062332
#VU119962 - Improper Authentication
CVE-2025-37731
CWE-287 Medium
No
No
8.19.8, 9.1.8, 9.2.2 15.12.2025 SB2025121524
SB2026041730
#VU116631 - Information Exposure Through Log Files
CVE-2025-37727
CWE-532 Medium
No
No
8.18.8, 8.19.5, 9.0.8, 9.1.5 06.10.2025 SB2025100653
SB2026031331
SB2026041730
#VU114385 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-54988
CWE-611 Medium
Available
Exploited
8.18.6, 8.19.3, 9.0.6, 9.1.3 22.08.2025 SB2025082219
SB2025083007
SB2025083008
and 33 more
#VU109603 - Deserialization of Untrusted Data
CVE-2025-32434
CWE-502 High
Available
No
8.19.8, 9.1.8 21.05.2025 SB20250521126
SB2025061310
SB2026011967
and 3 more
#VU108114 - Resource exhaustion
CVE-2024-52979
CWE-400 Medium
No
No
7.17.25, 8.16.0 01.05.2025 SB2025050126
SB2025121138
SB2026041711
#VU108112 - Improper Authentication
CVE-2016-11086
CWE-287 High
No
No
7.9.3 01.05.2025 SB2020092430
SB2020102234
#VU108109 - Permissions, Privileges, and Access Controls
CVE-2020-7020
CWE-264 Low
No
No
6.8.13, 7.9.3 01.05.2025 SB2020102234
SB2025050123
#VU107230 - Uncontrolled Recursion
CVE-2024-52981
CWE-674 Medium
No
No
7.17.24, 8.15.1 08.04.2025 SB2025040888
SB2025063009
SB2026041729
#VU107229 - Resource exhaustion
CVE-2024-52980
CWE-400 Medium
No
No
8.15.1 08.04.2025 SB2025040888
SB2025063009
SB2025120239
and 1 more
#VU103109 - Resource exhaustion
CVE-2024-43709
CWE-400 Medium
No
No
7.17.21, 8.13.3 21.01.2025 SB2025012117
SB2025041654
SB2025063009
#VU101819 - Improper Authorization
CVE-2024-12539
CWE-285 Low
No
No
8.16.2 18.12.2024 SB2024121809
#VU95145 - Cleartext Storage of Sensitive Information
CVE-2024-23444
CWE-312 Low
No
No
7.17.23, 8.13.0 01.08.2024 SB2024080141
SB2024112711
SB2024112732
and 6 more
#VU91270 - Uncaught Exception
CVE-2024-37280
CWE-248 Low
No
No
8.14.0 07.06.2024 SB2024060703
SB2024100410
#VU91269 - Permissions, Privileges, and Access Controls
CVE-2024-23445
CWE-264 Medium
No
No
8.14.0 07.06.2024 SB2024060703
SB2025063009
#VU91267 - Improper Authorization
CVE-2024-23451
CWE-285 Low
No
No
8.13.0 07.06.2024 SB2024060702
SB2024061114
SB2024100404
#VU91266 - Uncaught Exception
CVE-2024-23449
CWE-248 Low
No
No
8.11.1 07.06.2024 SB2024060701
#VU91263 - Information Exposure Through Log Files
CVE-2023-49921
CWE-532 Low
No
No
7.17.16, 8.11.2 06.06.2024 SB2024060639


Showing elements 21 - 40 out of 70