# Elastic Kibana


- [CVE-2019-7609](https://insights.sbomify.com/CVE-2019-7609/): Kibana Arbitrary Code Execution (critical 9.8, exploited in the wild)
- [CVE-2025-25015](https://insights.sbomify.com/CVE-2025-25015/): Kibana arbitrary code execution via prototype pollution (critical 9.9)
- [CVE-2024-37288](https://insights.sbomify.com/CVE-2024-37288/): Deserialization in Kibana (critical 9.9)
- [CVE-2023-31415](https://insights.sbomify.com/CVE-2023-31415/): Code injection in Kibana (critical 9.9)
- [CVE-2018-17245](https://insights.sbomify.com/CVE-2018-17245/): Information disclosure in Kibana (critical 9.8)
- [CVE-2018-17246](https://insights.sbomify.com/CVE-2018-17246/): Code injection in Kibana (critical 9.8)
- [CVE-2025-25014](https://insights.sbomify.com/CVE-2025-25014/): Kibana arbitrary code execution via prototype pollution (critical 9.1)
- [CVE-2024-37285](https://insights.sbomify.com/CVE-2024-37285/): Kibana arbitrary code execution via YAML deserialization (critical 9.1)
- [CVE-2024-37287](https://insights.sbomify.com/CVE-2024-37287/): Kibana arbitrary code execution via prototype pollution (critical 9.1)
- [CVE-2023-31422](https://insights.sbomify.com/CVE-2023-31422/): Kibana Insertion of Sensitive Information into Log File (critical 9.0)
- [CVE-2019-7610](https://insights.sbomify.com/CVE-2019-7610/): Code injection in Kibana (critical 9.0)
- [CVE-2026-102406](https://insights.sbomify.com/CVE-2026-102406/): Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/products/elastic/kibana/