Patchfirst: Elastic vulnerabilitieshttps://patchfirst.co/vendor/elastic/New and newly exploited Elastic CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2023-31419: Elasticsearch StackOverflow vulnerabilityhttps://patchfirst.co/cve/CVE-2023-31419/CVE-2023-31419Thu, 26 Oct 2023 00:00:00 GMTElastic · Elasticsearch. Not in CISA KEV. EPSS 61.1% (higher than 99.16% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. Priority 29.4 of 100.public-exploitCVE-2022-23714: A local privilege escalation (LPE) issue was discovered in the ransomware canaries features of Elastic Endpoint…https://patchfirst.co/cve/CVE-2022-23714/CVE-2022-23714Wed, 06 Jul 2022 00:00:00 GMTElastic · Endpoint Security. Not in CISA KEV. EPSS 0.2% (higher than 14.1% of CVEs). Priority 47.8 of 100.[KEV] CVE-2015-1427: Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2015-1427/CVE-2015-1427#kevFri, 25 Mar 2022 00:00:00 GMTElastic · Elasticsearch. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 79.9 of 100.kevpublic-exploitT1190T1059[KEV] CVE-2014-3120: Elasticsearch Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2014-3120/CVE-2014-3120#kevFri, 25 Mar 2022 00:00:00 GMTElastic · Elasticsearch. In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 88.6% (higher than 99.77% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.6 of 100.kevpublic-exploitT1190T1059[KEV] CVE-2019-7609: Kibana Arbitrary Code Executionhttps://patchfirst.co/cve/CVE-2019-7609/CVE-2019-7609#kevMon, 10 Jan 2022 00:00:00 GMTElastic · Kibana. In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS 95.3% (higher than 99.87% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.8 of 100.kevpublic-exploitT1190T1059CVE-2021-22145: A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reportinghttps://patchfirst.co/cve/CVE-2021-22145/CVE-2021-22145Wed, 21 Jul 2021 00:00:00 GMTElastic · Elasticsearch. Not in CISA KEV. EPSS 76.2% (higher than 99.54% of CVEs). Public exploit code exists. Priority 25.6 of 100.public-exploitCVE-2018-17246: Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console pluginhttps://patchfirst.co/cve/CVE-2018-17246/CVE-2018-17246Thu, 20 Dec 2018 00:00:00 GMTElastic · Kibana. Not in CISA KEV. EPSS 84.3% (higher than 99.7% of CVEs). Public exploit code exists. Priority 61.3 of 100.public-exploit