Sploitus

50 exploited vulnerabilities in Elasticsearch

Vulnerabilities with publicly known exploits

Vendors
Budibase, Apache, Amazon, Elastic, Mongodb, Unknown
With known exploits
50
Affected Budibase versions
< 3.39.12
Affected Elastic Elasticsearch versions
< 1.6.1, 1.3.8, 1.4.3, 1.2.0, 7.17.24, 8.15.1, 8.2.1, 7.17.25, 8.16.0, 7.17.29, 8.19.8, 9.1.8, 9.2.2, 7.17.12, 8.9.0, 8.15.0, 8.19.9, 9.1.9, 9.2.3, 7.13.3, 7.17.16, 8.11.2
Affected Icinga versions
< 2.11.10, 2.12.5
Affected Vmware Spring Ai versions
< 1.0.9, 1.1.8
Affected Nagios Log Server versions
< 2024
Affected Apereo Opencast versions
< 13.10, 14.3, 16.7
Affected Elastic Kibana versions
< 8.19.16, 9.3.5, 9.4.2
Affected Mattermost Mattermost Server versions
< 9.5.10

Vulnerabilities with exploits

Highest CVSS first — 8 of these already have exploit code on Sploitus

CVE-2026-54350 1 exploit
CVSS 10.0 CRITICAL 2026-06-23FIX AVAILABLE
Exploit for Improper Neutralization of Special Elements in Data Query Logic in Budibase
CVE-2025-35434
CVSS 9.8 CRITICAL 2025-09-17FIX AVAILABLE
CVE-2015-5377 2 exploits
CVSS 9.8 CRITICAL 2018-03-06
Exploit for Injection in Elastic ElasticsearchApache Groovy Deserialization of Untrusted Data Remote Code Execution Exploit 0day
CVE-2015-1427 21 exploits
CVSS 9.8 CRITICAL 2015-02-17FIX AVAILABLE
Exploit for CVE-2015-1427Exploit for OS Command Injection in Gnu Bash
CVE-2025-12977
CVSS 9.4 CRITICAL 2025-11-24
CVE-2021-32743
CVSS 9.0 HIGH 2021-07-15FIX AVAILABLE
CVE-2026-47835
CVSS 8.6 HIGH 2026-06-15FIX AVAILABLE
CVE-2025-44824
CVSS 8.5 HIGH 2025-04-02FIX AVAILABLE
CVE-2014-3120 16 exploits
CVSS 8.1 HIGH 2014-07-28FIX AVAILABLE
Exploit for Improper Access Control in ElasticsearchExploit for Improper Access Control in Elasticsearch
CVE-2024-52981
CVSS 7.8 HIGH 2025-04-08
CVE-2024-43709
CVSS 7.8 HIGH 2025-01-21
CVE-2023-31418
CVSS 7.8 HIGH 2023-10-26
CVE-2022-23712
CVSS 7.8 HIGH 2022-06-06FIX AVAILABLE
CVE-2024-52979
CVSS 7.5 HIGH 2025-05-01
CVE-2024-52797
CVSS 7.5 HIGH 2024-11-20FIX AVAILABLE
CVE-2024-23444
CVSS 7.5 HIGH 2024-07-31FIX AVAILABLE
CVE-2024-23450
CVSS 7.5 HIGH 2024-01-16
CVE-2022-42123
CVSS 7.5 HIGH 2022-11-15FIX AVAILABLE
CVE-2025-37731
CVSS 7.4 HIGH 2025-12-15
CVE-2024-23445
CVSS 6.8 MEDIUM 2024-01-16FIX AVAILABLE
CVE-2023-31419 4 exploits
CVSS 6.8 MEDIUM 2023-09-18
Elasticsearch - StackOverflow DoS ExploitElasticsearch - StackOverflow DoS
CVE-2026-35211
CVSS 6.5 MEDIUM 2026-07-08FIX AVAILABLE
CVE-2026-56148
CVSS 6.5 MEDIUM 2026-07-01FIX AVAILABLE
CVE-2026-49090
CVSS 6.5 MEDIUM 2026-07-01
CVE-2026-49095
CVSS 6.5 MEDIUM 2026-05-28
CVE-2025-68384
CVSS 6.5 MEDIUM 2025-12-18
CVE-2024-52980
CVSS 6.5 MEDIUM 2025-04-08
CVE-2024-12539
CVSS 6.5 MEDIUM 2024-12-11
CVE-2024-7610
CVSS 6.5 MEDIUM 2024-08-07FIX AVAILABLE
CVE-2024-23451
CVSS 6.5 MEDIUM 2024-01-16FIX AVAILABLE
CVE-2023-46673
CVSS 6.5 MEDIUM 2023-11-22
CVE-2021-22145 5 exploits
CVSS 6.5 MEDIUM 2021-07-21FIX AVAILABLE
Elasticsearch Memory DisclosureElasticsearch Memory Disclosure
CVE-2023-46674
CVSS 6.0 MEDIUM 2023-12-05
CVE-2026-5417
CVSS 5.8 MEDIUM 2026-04-02FIX AVAILABLE
CVE-2025-37727
CVSS 5.7 MEDIUM 2025-10-08FIX AVAILABLE
CVE-2025-12978
CVSS 5.5 MEDIUM 2025-09-24
CVE-2024-32037
CVSS 5.3 MEDIUM 2025-02-11FIX AVAILABLE
CVE-2024-10241
CVSS 5.3 MEDIUM 2024-10-29FIX AVAILABLE
CVE-2024-23449
CVSS 5.3 MEDIUM 2024-03-29FIX AVAILABLE
CVE-2023-49921
CVSS 5.2 MEDIUM 2023-12-19FIX AVAILABLE
CVE-2015-5531 7 exploits
CVSS 5.0 MEDIUM 2015-08-17FIX AVAILABLE
Exploit for CVE-2015-1427Elasticsearch < 1.6.1 LFI
CVE-2026-56149
CVSS 4.9 MEDIUM 2026-07-01
CVE-2025-68390
CVSS 4.9 MEDIUM 2025-12-18
CVE-2024-39810
CVSS 4.9 MEDIUM 2024-08-22FIX AVAILABLE
CVE-2024-37280
CVSS 4.9 MEDIUM 2024-06-13
CVE-2024-52032
CVSS 4.3 MEDIUM 2024-11-09FIX AVAILABLE
CVE-2022-38299
CVSS 4.3 MEDIUM 2022-09-12FIX AVAILABLE
CVE-2022-23708
CVSS 4.3 MEDIUM 2022-03-03FIX AVAILABLE
CVE-2015-3337 4 exploits
CVSS 4.3 MEDIUM 2015-04-29FIX AVAILABLE
ElasticSearch 1.4.5 / 1.5.2 - Path Transversal VulnerabilityElasticSearch 1.4.5 1.5.2 - Directory Traversal
CVE-2023-31417
CVSS 4.1 MEDIUM 2023-09-07FIX AVAILABLE