[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqvpjNZZ7rgvO6mv8T9-tJ8jt5hu7lUy0mlLoOq7blQY":3},{"report":4,"cves":22,"nav":99},{"id":5,"week_start":6,"week_end":7,"week_label":8,"year":9,"week_number":10,"total_cves":11,"critical_count":12,"high_count":13,"medium_count":14,"low_count":12,"kev_count":12,"top_products":15,"summary_en":19,"is_published":20,"created_at":21},"9662b6a8-9c62-4c87-a331-b69f04cff6ce","2026-10-05","2026-10-11","2026-W41",2026,41,6,0,2,4,[16],{"name":17,"slug":18,"count":11},"Elasticsearch","elasticsearch",null,true,"2026-10-12T08:00:37.995732+00:00",{"critical":23,"high":24,"medium":44,"low":97,"kev":98},[],[25,36],{"cveId":26,"severity":27,"cvssScore":28,"description":29,"publishedAt":30,"url":31,"productSlug":18,"productName":17,"productLogo":32,"cycle":33,"isKev":34,"epssScore":35},"CVE-2026-103007","HIGH",7.2,"Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definit","2026-10-06T20:17:13.93+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-103007","https:\u002F\u002Fcdn.simpleicons.org\u002Felasticsearch","9.4",false,0.0034,{"cveId":37,"severity":27,"cvssScore":38,"description":39,"publishedAt":40,"url":41,"productSlug":18,"productName":17,"productLogo":32,"cycle":42,"isKev":34,"epssScore":43},"CVE-2026-103009",7.1,"Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, indepen","2026-10-06T20:17:14.247+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-103009","9.3",0.00231,[45,54,61,68,74,79,84,89],{"cveId":46,"severity":47,"cvssScore":48,"description":49,"publishedAt":50,"url":51,"productSlug":18,"productName":17,"productLogo":32,"cycle":52,"isKev":34,"epssScore":53},"CVE-2026-103006","MEDIUM",6.5,"Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhaust","2026-10-06T20:17:13.73+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-103006","9.0",0.0041,{"cveId":55,"severity":47,"cvssScore":56,"description":57,"publishedAt":58,"url":59,"productSlug":18,"productName":17,"productLogo":32,"cycle":42,"isKev":34,"epssScore":60},"CVE-2026-102408",4.3,"Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that t","2026-10-06T20:17:12.777+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102408",0.00347,{"cveId":62,"severity":47,"cvssScore":48,"description":63,"publishedAt":64,"url":65,"productSlug":18,"productName":17,"productLogo":32,"cycle":66,"isKev":34,"epssScore":67},"CVE-2026-103005","Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.","2026-10-06T20:17:13.597+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-103005","9.5",0.00309,{"cveId":69,"severity":47,"cvssScore":48,"description":70,"publishedAt":71,"url":72,"productSlug":18,"productName":17,"productLogo":32,"cycle":73,"isKev":34,"epssScore":67},"CVE-2026-102411","Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates* cluster privilege can register multiple resources each within the individual limit. Retrieving them tog","2026-10-06T20:17:13.18+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102411","9.2",{"cveId":75,"severity":47,"cvssScore":48,"description":76,"publishedAt":77,"url":78,"productSlug":18,"productName":17,"productLogo":32,"cycle":66,"isKev":34,"epssScore":67},"CVE-2026-102409","Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).","2026-10-06T20:17:12.907+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102409",{"cveId":80,"severity":47,"cvssScore":48,"description":81,"publishedAt":82,"url":83,"productSlug":18,"productName":17,"productLogo":32,"cycle":66,"isKev":34,"epssScore":67},"CVE-2026-103008","Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text, which is subject to a nesting-depth limit, geometry constructed from a script's output is not boun","2026-10-06T20:17:14.12+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-103008",{"cveId":85,"severity":47,"cvssScore":48,"description":86,"publishedAt":87,"url":88,"productSlug":18,"productName":17,"productLogo":32,"cycle":66,"isKev":34,"epssScore":67},"CVE-2026-102404","Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability.","2026-10-06T20:17:12.333+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102404",{"cveId":90,"severity":47,"cvssScore":91,"description":92,"publishedAt":93,"url":94,"productSlug":18,"productName":17,"productLogo":32,"cycle":95,"isKev":34,"epssScore":96},"CVE-2026-102407",5.4,"Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a","2026-10-06T20:17:12.647+00:00","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102407","8.16",0.00218,[],[],{"prev":100,"next":19},"2026-W40"]