Kibana is a free and open frontend application that sits on top of the Elastic Stack, providing search and data visualization capabilities for data indexed in Elasticsearch. Commonly known as the charting tool for the Elastic Stack, Kibana also acts as the user interface for monitoring, managing, and securing an Elastic Stack cluster—as well as the centralized hub for built-in solutions developed on the Elastic Stack.

Kibana

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to render HTML tags within a user’s browser via the integration package upload functionality. This issue is related to ESA-2025-17 (CVE-2025-25018) bypassing that fix to achieve HTML injection.

CVE-2025-37732

NixOS

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
CVE-2026-0543	MEDIUM	6.5	Kibana	cpe:2.3:a:elastic:kibana	No	Yes	Jan 13, 2026
CVE-2026-0531	MEDIUM	6.5	Kibana	cpe:2.3:a:elastic:kibana	No	Yes	Jan 13, 2026
CVE-2026-0530	MEDIUM	6.5	Kibana	cpe:2.3:a:elastic:kibana	No	Yes	Jan 13, 2026
CVE-2025-68389	MEDIUM	6.5	Kibana	cpe:2.3:a:elastic:kibana	No	Yes	Dec 18, 2025
CVE-2025-68422	MEDIUM	4.3	Kibana	cpe:2.3:a:elastic:kibana	No	Yes	Dec 18, 2025

CVE-2025-37732:
Kibana vulnerability analysis and mitigation

5.4

Related Kibana vulnerabilities:

Benchmark your Cloud Security Posture

Additional Wiz resources

Cloud Vulnerability DB

Cloud Threat Landscape

PEACH

Ready to see Wiz in action?

CVE-2025-37732: Kibana vulnerability analysis and mitigation