kibana-9.0 | Snyk

Direct Vulnerabilities

Known vulnerabilities in the kibana-9.0 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Improper Encoding or Escaping of Output	*
L Arbitrary Code Injection	*
L Incomplete Blacklist	*
L Information Exposure Through Log Files	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
M Improper Validation of Specified Quantity in Input	*
H Uncontrolled Recursion	*
L Inefficient Regular Expression Complexity	*
H Improper Verification of Cryptographic Signature	*
L CVE-2026-72662	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L Improper Certificate Validation	*
L Information Exposure Through Server Error Message	*
L Arbitrary Code Injection	*
L CVE-2026-78582	*
L Arbitrary Code Injection	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L GHSA-p634-w6r4-rjp2	*
L GHSA-8238-w5pm-2374	*
L GHSA-8vvx-rff5-p5rq	*
L CVE-2026-17495	*
L Insufficient Comparison	*
L Resource Exhaustion	*
L CVE-2026-86472	*
L GHSA-c6fg-446q-cg94	*
L CVE-2026-19534	*
L Resource Exhaustion	*
L CVE-2026-94400	*
L Resource Exhaustion	*
L Incorrect Permission Assignment for Critical Resource	*
L GHSA-v53p-9fqp-m79j	*
L GHSA-253c-mchw-3w2r	*
L CVE-2026-18540	*
L GHSA-rcw4-f5rp-g42v	*
L Resource Exhaustion	*
H Inefficient Regular Expression Complexity	*
L CVE-2026-84292	*
L Insufficient Comparison	*
L GHSA-6vj9-mwq6-2f5v	*
L CVE-2026-12866	*
L Uncontrolled Memory Allocation	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L CVE-2026-82299	*
L Resource Exhaustion	*
L CVE-2026-82298	*
L CVE-2026-78596	*
L GHSA-2x7j-588g-ccc2	*
L GHSA-8m3c-c648-2xjj	*
L CVE-2026-19693	*
L CVE-2026-82302	*
M Link Following	*
L CVE-2026-78583	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L CVE-2026-78593	*
L GHSA-wmmp-3585-3rmp	*
L CVE-2026-82293	*
L CVE-2026-78591	*
L CVE-2026-78598	*
L CVE-2026-78599	*
L CVE-2026-78586	*
L CVE-2026-78590	*
L CVE-2026-78608	*
L CVE-2026-75975	*
L CVE-2026-78592	*
L CVE-2026-78603	*
L CVE-2026-72628	*
L CVE-2026-33465	*
L CVE-2026-72652	*
L CVE-2026-72654	*
L CVE-2026-76172	*
L CVE-2026-78597	*
L Integer Overflow or Wraparound	*
L CVE-2026-8657	*
L CVE-2026-45822	*
L CVE-2026-72650	*
L CVE-2026-72664	*
M CVE-2026-72670	*
L CVE-2026-72660	*
L CVE-2026-72673	*
L CVE-2026-72671	*
L CVE-2026-72669	*
L CVE-2026-72658	*
L CVE-2026-72677	*
L CVE-2026-72651	*
L CVE-2026-72675	*
L CVE-2026-72659	*
L CVE-2026-72663	*
L CVE-2026-49089	*
L CVE-2026-72653	*
L CVE-2026-72667	*
L CVE-2026-49096	*
L CVE-2026-72655	*
L CVE-2026-72661	*
L CVE-2026-72665	*
L CVE-2026-72630	*
L CVE-2026-72632	*
L CVE-2026-72629	*
L CVE-2026-56876	*
L CVE-2026-63142	*
L CVE-2026-63143	*
L CVE-2026-13149	*
L Interpretation Conflict	*
M CVE-2026-16728	*
H OS Command Injection	*
L CVE-2026-18446	*
L GHSA-42h9-826w-cgv3	*
L CVE-2026-56151	*
L CVE-2026-63145	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Cleartext Transmission of Sensitive Information	*
L Algorithmic Complexity	*
L GHSA-mmx7-hfxf-jppx	*
L GHSA-wqvq-jvpq-h66f	*
L CVE-2026-6733	*
L CVE-2026-49087	*
L Algorithmic Complexity	*
L Uncaught Exception	*
L GHSA-r292-9mhp-454m	*
L CVE-2026-39244	*
L Resource Exhaustion	*
L Algorithmic Complexity	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
L Improper Input Validation	*
L Directory Traversal	*
L Resource Exhaustion	*
L GHSA-7q8q-rj6j-mhjq	*
L CVE-2026-63261	*
L GHSA-268h-hp4c-crq3	*
L GHSA-pmv8-rq9r-6j72	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
M CVE-2026-63141	*
L CVE-2026-11525	*
L CVE-2026-13676	*
L Uncontrolled Recursion	*
L GHSA-5p4m-2wfm-xmqj	*
M Resource Exhaustion	*
M CVE-2026-15157	*
L CVE-2026-56147	*
L CVE-2026-9679	*
L CVE-2026-14257	*
M CVE-2026-16729	*
L CVE-2026-63139	*
L Incorrect Type Conversion or Cast	*
L CVE-2026-16221	*
L GHSA-r7g4-qg5f-qqm2	*
L CVE-2026-63260	*
L GHSA-jqh4-m9w3-8hp9	*
L Uncaught Exception	*
L Allocation of Resources Without Limits or Throttling	*
L Uncaught Exception	*
L Allocation of Resources Without Limits or Throttling	*
H Inefficient Regular Expression Complexity	*
L CVE-2026-49088	<9.0.8-r0
L CVE-2026-12151	*
L Uncontrolled Recursion	*
L GHSA-p6gq-j5cr-w38f	*
L Resource Exhaustion	*
L CVE-2026-12143	*
L Resource Exhaustion	*
L Uncaught Exception	*
L Uncaught Exception	*
L Information Exposure	*
H Information Exposure	*
L Allocation of Resources Without Limits or Throttling	*
L Server-Side Request Forgery (SSRF)	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L Information Exposure	*
L CVE-2026-49095	*
L CVE-2026-33463	*
L CVE-2026-42399	*
L CVE-2026-42398	*
L CVE-2026-33464	*
H Arbitrary Code Injection	*
L CVE-2026-42400	*
H Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
H CVE-2026-33462	*
M CVE-2026-42401	*
L Interpretation Conflict	*
L Unintended Proxy or Intermediary ('Confused Deputy')	*
H Use of Uninitialized Resource	*
H Uncontrolled Recursion	*
L CVE-2026-26939	*
L CVE-2026-33459	*
M CVE-2026-33461	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L Improper Handling of Unicode Encoding	*
C Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
M Cross-site Scripting (XSS)	*
L Improper Handling of Exceptional Conditions	*
H Arbitrary Code Injection	*
L Improper Input Validation	*
L CVE-2026-6322	*
L OS Command Injection	*
L Deserialization of Untrusted Data	*
L CVE-2026-6321	*
L Resource Exhaustion	*
L Uncontrolled Recursion	*
L Arbitrary Code Injection	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L Improper Encoding or Escaping of Output	*
L Allocation of Resources Without Limits or Throttling	*
L HTTP Response Splitting	*
H Server-Side Request Forgery (SSRF)	*
M Improper Authentication	*
L Allocation of Resources Without Limits or Throttling	*
H Uncontrolled Recursion	*
C Improperly Controlled Modification of Dynamically-Determined Object Attributes	*
L Permissive Whitelist	*
L CRLF Injection	*
C Permissive Whitelist	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L Improper Validation of Specified Quantity in Input	*
L Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	*
M CVE-2026-26940	*
L Uncontrolled Recursion	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
L GHSA-c7w3-x93f-qmm8	*
M Cross-site Scripting (XSS)	*
C Improper Certificate Validation	*
L Improper Input Validation	*
L Inefficient Regular Expression Complexity	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L Improper Verification of Cryptographic Signature	*
H Resource Exhaustion	*
L Arbitrary Code Injection	*
L Improper Check for Unusual or Exceptional Conditions	*
H Cross-site Scripting (XSS)	*
L GHSA-442j-39wm-28r2	*
L GHSA-7rx3-28cr-v5wh	*
L Arbitrary Code Injection	*
L Arbitrary Code Injection	*
M CVE-2026-2950	*
C CVE-2026-4800	*
H Inefficient Regular Expression Complexity	*
C Arbitrary Code Injection	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L GHSA-r4q5-vmmm-2653	*
M HTTP Response Splitting	*
C Unintended Proxy or Intermediary ('Confused Deputy')	*
L GHSA-6v7q-wjvx-w8wg	*
L Information Exposure	*
L Resource Exhaustion	*
L GHSA-vvjj-xcjg-gr5g	*
H Out-of-bounds Write	*
L XML Injection	*
L CVE-2026-1527	*
L CVE-2026-1526	*
L CVE-2026-26934	*
M Directory Traversal	*
H CVE-2026-26936	*
C CVE-2026-1525	*
H CVE-2026-26937	*
M Directory Traversal	*
L CVE-2026-2229	*
H CVE-2026-26935	*
L CVE-2026-3449	*
L CVE-2026-1528	*
L CVE-2025-68389	*
C Directory Traversal	*
L Algorithmic Complexity	*
L CVE-2025-68387	*
L Inefficient Regular Expression Complexity	*
L CVE-2026-0530	*
L CVE-2025-68422	*
L Allocation of Resources Without Limits or Throttling	*
H Server-Side Request Forgery (SSRF)	*
L CVE-2026-0531	*
L CVE-2025-37732	*
L CVE-2026-0532	*
H Buffer Overflow	*
M CVE-2025-68385	*
L CVE-2025-68386	*
M CVE-2025-25009	<9.0.8-r0
L CVE-2025-37728	<9.0.8-r0
M CVE-2025-25018	<9.0.8-r0
M CVE-2025-25017	<9.0.7-r0
L OS Command Injection	*
H Inefficient Regular Expression Complexity	*
H Directory Traversal	*
L Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')	*
L Inefficient Regular Expression Complexity	*
L Incorrect Regular Expression	*
H OS Command Injection	*
L CVE-2026-2739	*
L Server-Side Request Forgery (SSRF)	*
H CVE-2026-2327	*
L Improper Check for Unusual or Exceptional Conditions	*
L Directory Traversal	*
L Improper Input Validation	*
M CVE-2025-13465	*
M Improper Handling of Unicode Encoding	*
L GHSA-6475-r3vj-m8vf	*
M Directory Traversal	*
H Allocation of Resources Without Limits or Throttling	*
C Deserialization of Untrusted Data	*
H Improper Check or Handling of Exceptional Conditions	*
L Improper Verification of Cryptographic Signature	*
H Uncontrolled Recursion	*
H Improper Check or Handling of Exceptional Conditions	*
L CVE-2025-12816	*
M Integer Overflow or Wraparound	*
L CVE-2025-13204	*
L OS Command Injection	*
L Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	*
L Arbitrary Code Injection	*
M CVE-2025-48985	*
H Improper Validation of Syntactic Correctness of Input	*
M Cross-site Scripting (XSS)	*
L Allocation of Resources Without Limits or Throttling	<9.0.8-r0
L CVE-2025-9910	*
L Directory Traversal	<9.0.8-r0

Vulnerability

Vulnerable Version

Improper Encoding or Escaping of Output