Security releases

Researcher credits in vendor advisories

Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.

Vendor

These 19 releases credit 0 lines. 0 are still open to claim.

One mark per credit line Open Claimed

Elastic CVE-2026-115716

Allocation of Resources Without Limits or Throttling (CWE-770) in APM Server can lead to denial of service via Oversized Serialized Data Payloads (CAPEC-231). A

0 CVEs and 0 credit lines.
Elastic CVE-2026-115715

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is proces

0 CVEs and 0 credit lines.
Elastic CVE-2026-115714

Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat,

0 CVEs and 0 credit lines.
Elastic CVE-2026-115710

Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted s

0 CVEs and 0 credit lines.
Elastic CVE-2026-115298

Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An

0 CVEs and 0 credit lines.
Elastic CVE-2026-115297

NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthentic

0 CVEs and 0 credit lines.
Elastic CVE-2026-115295

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by

0 CVEs and 0 credit lines.
Elastic CVE-2026-115294

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (

0 CVEs and 0 credit lines.
Elastic CVE-2026-115293

Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to con

0 CVEs and 0 credit lines.
Elastic CVE-2026-115292

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properl

0 CVEs and 0 credit lines.
Elastic CVE-2026-115290

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacke

0 CVEs and 0 credit lines.
Elastic CVE-2026-115289

Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration reque

0 CVEs and 0 credit lines.

Elastic CVE-2026-115713

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data

0 CVEs and 0 credit lines.
Elastic CVE-2026-115712

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality

0 CVEs and 0 credit lines.
Elastic CVE-2026-115711

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure vi

0 CVEs and 0 credit lines.
Elastic CVE-2026-115709

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data b

0 CVEs and 0 credit lines.
Elastic CVE-2026-115708

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized cha

0 CVEs and 0 credit lines.
Elastic CVE-2026-115707

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via

0 CVEs and 0 credit lines.
Elastic CVE-2026-115706

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). A

0 CVEs and 0 credit lines.