floragunn GmbH
First CVE: Aug 12, 2019Active for: 7 years
16
CVEs Published
More CVEs Published than 36% of tracked CNAs
5.3
Avg CVEs / Year
More Avg CVEs / Year than 34% of tracked CNAs
6.3
Avg CVSS Score
Higher Avg CVSS Score than 17% of tracked CNAs
0.0%
In CISA KEV
Bottom 1%
Trends Over Time
The number and severity of CVEs published by floragunn GmbH over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 12, 2019
6 years ago
Most Recent CVE
Mar 31, 2026
115 days ago
Top CVEs
All CVEs published by floragunn GmbH as a CNA, regardless of affected vendor or product.
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-13423HIGH Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user could impersonate as kibanaserver user when providing wrong cr | Aug 23, 2019 | 8.8 | 26 | NO | NO |
CVE-2026-4818HIGH In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data st | Mar 31, 2026 | 8.1 | 25 | NO | NO |
CVE-2019-13419HIGH Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. | Aug 13, 2019 | 7.5 | 23 | NO | NO |
CVE-2019-13418HIGH Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. | Aug 12, 2019 | 7.5 | 23 | NO | NO |
CVE-2026-4819MEDIUM In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana. | Mar 31, 2026 | 6.5 | 22 | NO | NO |
CVE-2019-13415MEDIUM Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see. | Aug 13, 2019 | 6.5 | 22 | NO | NO |
CVE-2025-12149MEDIUM In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS rule | Nov 14, 2025 | 6.0 | 21 | NO | NO |
CVE-2025-12148MEDIUM In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address).
While the content of these fields is properly redac | Oct 29, 2025 | 6.0 | 21 | NO | NO |
CVE-2025-12147MEDIUM In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields.
When an FLS exclusion rule (e.g., ~field) is app | Oct 29, 2025 | 6.0 | 21 | NO | NO |
CVE-2019-13416MEDIUM Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on t | Aug 13, 2019 | 6.5 | 21 | NO | NO |
CVE Severity & Scoring
Severity distribution of CVEs published by this CNA16 CVEs
75%
25%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network16 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low15 (93.8%)
High1 (6.3%)
Unknown0 (0.0%)
User Interaction
None14 (87.5%)
Unknown0 (0.0%)
Required2 (12.5%)
Privileges Required
Low9 (56.3%)
High1 (6.3%)
None6 (37.5%)
Unknown0 (0.0%)
Exploit Exposure
Signals from CVEs in this cna scope (16 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
An overview of all social media posts that mention a CVE ID published by floragunn GmbH as a CNA.
Media Mentions
Media articles that mention a CVE ID published by floragunn GmbH as a CNA — matched by CVE ID, not by organization name.