Data Management and Analytics

In Kibana versions 7.0.0 through 7.17.29, 8.0.0 through 8.18.7, 8.19.0 through 8.19.3, 9.0.0 through 9.0.6, and 9.1.0 through 9.1.3, a high severity vulnerability CVE-2025-25017 was detected. This vulnerability allows remote attackers to inject arbitrary web script or HTML via improperly neutralized input during web page generation in Vega visualizations. Users should update Kibana to versions 8.18.8, 8.19.4, 9.0.7, or 9.1.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-25017.

In Apache Spark versions before 3.4.4, 3.5.2, and 4.0.0 a medium severity vulnerability CVE-2025-55039 was detected. When spark.network.crypto.enabled is true but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To address this issue, users should upgrade Apache Spark to 3.4.4, 3.5.2, or 4.0.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-55039.

In Kibana versions prior to 8.18.8, 8.19.5, 9.0.8, and 9.1.5 a high severity vulnerability CVE-2025-25018 was detected. Improper neutralization of input during web page generation allows an attacker to inject and store malicious scripts, leading to stored Cross-Site Scripting. To address this issue, users should upgrade Kibana to versions 8.18.8, 8.19.5, 9.0.8, or 9.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-25018.

In Elasticsearch versions prior to all versions from 7.0.0 up to and including 7.17.29, from 8.0.0 up to and including 8.18.7, from 8.19.0 up to and including 8.19.4, from 9.0.0 up to and including 9.0.7, and from 9.1.0 up to and including 9.1.4 a medium severity vulnerability CVE-2025-37727 was detected. This vulnerability allows sensitive information to be inserted into log files when auditing requests to the reindex API, potentially leading to a loss of confidentiality under specific conditions. To address this issue, users should update Elasticsearch to versions 8.18.8, 8.19.5, 9.0.8 or 9.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-37727.

In Grafana Image Renderer versions 1.0.0 through 4.0.16 a critical severity vulnerability CVE-2025-11539 was detected.This vulnerability allows attackers to achieve remote code execution by writing arbitrary files via the /render/csv endpoint—when the filePath parameter is not validated—which are then loaded by the Chromium process, and affects instances where the default token (authToken) is unchanged or known to the attacker and the endpoint is reachable. To address this issue, users should upgrade Grafana to version 4.0.17 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-11539.

In Redis versions 8.2.1 and below a high severity vulnerability CVE-2025-46817 was detected. Authenticated users can use specially crafted Lua scripts to trigger an integer overflow that may lead to remote code execution. This issue affects all Redis versions with Lua scripting enabled. To address this issue, users should upgrade Redis to version 8.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-46817.

In Redis versions 8.2.1 and below a high severity vulnerability CVE-2025-49844 was detected. Authenticated users can use a specially crafted Lua script to manipulate the garbage collector, triggering a use-after-free condition that may lead to remote code execution. This issue affects all Redis versions with Lua scripting enabled. To address this issue, users should upgrade Redis to version 8.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49844.

In Redis versions 8.2.1 and below a medium severity vulnerability CVE-2025-46819 was detected. Authenticated users can use specially crafted Lua scripts to read out-of-bounds data or crash the server, leading to denial of service (DoS). This issue affects all Redis versions with Lua scripting enabled. To address this issue, users should upgrade Redis to version 8.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-46819.

In Kibana versions 7.x prior to and including 7.17.29, 8.x from 8.14.0 up to 8.18.7, 8.19.x from 8.19.0 up to 8.19.4, 9.0.x from 9.0.0 up to 9.0.7, and 9.1.x from 9.1.0 up to 9.1.4 a medium severity vulnerability CVE-2025-37728 was detected. Insufficiently protected credentials in the CrowdStrike connector can lead to CrowdStrike credentials being leaked. A malicious user can access cached credentials from a CrowdStrike connector in another space by creating and running a CrowdStrike connector in a space to which they have access. To address this issue, users should update Kibana to versions 8.18.8, 8.19.5, 9.0.8, or 9.1.5. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-37728.