Kibana Archives • Daily CyberSecurity

Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend

Elastic Stack vulnerabilities CVE-2026-102406 and CVE-2026-103007 in Kibana and Elasticsearch fixed in 8.19.23, 9.4.8 and 9.5.5

Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend

Do Son October 7, 2026

Elastic fixes 14 Elastic Stack vulnerabilities, including Kibana flaw CVE-2026-102406 and Elasticsearch bug CVE-2026-103007. Upgrade now.

Elastic Stack Under Fire: 7 New Flaws Expose Files & Crash Servers Elastic Security Update CVE-2026-0532 Elastic Defend Arbitrary Delete, SYSTEM Privilege Escalation ECE Readonly EoP, Improper Authorization Elastic XSS, Kibana Vulnerabilities Elastic LPE, Observability Tools Vulnerabilities

Elastic Stack Under Fire: 7 New Flaws Expose Files & Crash Servers

Do Son January 14, 2026

Elastic patches 7 high-severity flaws (CVSS 8.6) in Kibana & Elasticsearch. CVE-2026-0532 allows SSRF & file theft. Update to v8.19.10 now.

Visualizations Weaponized: New Kibana Flaw Allows XSS Attacks via Vega Charts Kibana Vega XSS, Elastic Stack Security CVE-2024-37287 - Kibana security update

Kibana Vega XSS, Elastic Stack Security CVE-2024-37287 - Kibana security update

Visualizations Weaponized: New Kibana Flaw Allows XSS Attacks via Vega Charts

Do Son December 19, 2025

Elastic patches a High-severity XSS flaw (CVE-2025-68385) in Kibana. Attackers can weaponize Vega visualizations to hijack sessions. Update now!

Elastic Patches Two Kibana Flaws — SSRF (CVE-2025-37734) and XSS (CVE-2025-59840) Flaws Affect Multiple Versions CVE-2024-37288 and CVE-2024-37285 Kibana XSS SSRF, Vega Vulnerability

CVE-2024-37288 and CVE-2024-37285 Kibana XSS SSRF, Vega Vulnerability

Elastic Patches Two Kibana Flaws — SSRF (CVE-2025-37734) and XSS (CVE-2025-59840) Flaws Affect Multiple Versions

Do Son November 13, 2025

Elastic patched two Kibana flaws: CVE-2025-59840 XSS via Vega visualizations and CVE-2025-37734 (SSRF) via the Observability AI Assistant. Update to v9.2.1 immediately.

Elastic Fixes Multiple High-Severity Vulnerabilities in Kibana and Elasticsearch Elastic Security Update CVE-2026-0532 Elastic Defend Arbitrary Delete, SYSTEM Privilege Escalation ECE Readonly EoP, Improper Authorization Elastic XSS, Kibana Vulnerabilities Elastic LPE, Observability Tools Vulnerabilities

Elastic Fixes Multiple High-Severity Vulnerabilities in Kibana and Elasticsearch

Do Son October 7, 2025

Elastic patched five flaws in Kibana/Elasticsearch, including three Critical XSS issues (CVE-2025-25009) and credential leaks, urging immediate upgrades to v8.18.8+.

Critical Kibana Flaws: CVE-2025-2135 (CVSS 9.9) Allows Heap Corruption & RCE; Open Redirect Also Patched Kibana Vulnerabilities, Code Execution

Critical Kibana Flaws: CVE-2025-2135 (CVSS 9.9) Allows Heap Corruption & RCE; Open Redirect Also Patched

Do Son June 25, 2025

Elastic patches two Kibana flaws: CVE-2025-2135 (CVSS 9.9) allows heap corruption/RCE via Chromium, and CVE-2025-25012 (CVSS 4.3) is an open redirect/SSRF risk.

High-Severity Flaw in Kibana: Unauthorized Access Possible in Synthetic Monitoring! Kibana Vulnerability, Elastic Security

High-Severity Flaw in Kibana: Unauthorized Access Possible in Synthetic Monitoring!

Do Son June 11, 2025

A high-severity flaw (CVE-2024-43706) in Kibana's Synthetic Monitoring allows unauthorized access. Upgrade to 8.12.1 or apply mitigations immediately.

CVE-2025-25014 (CVSS 9.1): Prototype Pollution in Kibana Opens Door to Code Execution CVE-2024-43707 Kibana vulnerability Prototype pollution CVE-2025-25014

CVE-2024-43707 Kibana vulnerability Prototype pollution CVE-2025-25014

CVE-2025-25014 (CVSS 9.1): Prototype Pollution in Kibana Opens Door to Code Execution

Do Son May 7, 2025

A critical vulnerability in Kibana (CVE-2025-25014) enables arbitrary code execution via prototype pollution. Elastic urges users to patch immediately.

Kibana Code Injection Vulnerability: Prototype Pollution Threat (CVE-2024-12556) CVE-2024-43707 Kibana vulnerability Prototype pollution CVE-2025-25014

Kibana Code Injection Vulnerability: Prototype Pollution Threat (CVE-2024-12556)

Do Son April 9, 2025

A vulnerability (CVE-2024-12556) in Kibana allows code injection via prototype pollution, file upload, and path traversal. Upgrade to the latest version or disable the integration assistant to mitigate this high-severity security risk.

CVE-2025-25015 (CVSS 9.9): Critical Code Execution Vulnerability Patched in Elastic Kibana

Do Son March 5, 2025

Learn about CVE-2025-25015: a serious vulnerability in Kibana that poses risks of arbitrary code execution on systems.

CVE-2024-43707: Kibana Patches High Severity Vulnerability Exposing Sensitive Information CVE-2024-43707 Kibana vulnerability Prototype pollution CVE-2025-25014

CVE-2024-43707: Kibana Patches High Severity Vulnerability Exposing Sensitive Information

Do Son January 23, 2025

Take action to secure your Elastic Agent policies. Discover how the high severity vulnerability CVE-2024-43707 could compromise sensitive information in Kibana.

Critical Kibana Flaws (CVE-2024-37288, CVE-2024-37285) Expose Systems to Arbitrary Code Execution CVE-2024-37288 and CVE-2024-37285 Kibana XSS SSRF, Vega Vulnerability

Critical Kibana Flaws (CVE-2024-37288, CVE-2024-37285) Expose Systems to Arbitrary Code Execution

Do Son September 8, 2024

URGENT: Critical security advisory for Kibana users. Update to version 8.15.1 now to mitigate vulnerabilities CVE-2024-37288 and CVE-2024-37285.