7 CVEs matched to Cribl by name in NVD, none on CISA's Known Exploited list.
Back to the Cribl profile · Alternatives to Cribl · CVE RSS feed
1 CVE has an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request.
A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the co…
Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and p…
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 1 | 0 | 0 | 6 |
| 2019 | 1 | 0 | 0 | 0 | 0 | 1 |
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2019-11076 | 3.5% | 89% |
| CVE-2026-45391 | 1.7% | 77% |
| CVE-2026-56748 | 0.9% | 60% |
| CVE-2026-56747 | 0.7% | 51% |
| CVE-2026-45392 | 0.5% | 43% |
| CVE-2026-45393 | 0.4% | 32% |
| CVE-2026-78593 | 0.3% | 21% |
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a s…
Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute a…
DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated u…
A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default…
Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScrip…
A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges to NT AUTHORITY\SYSTEM. Incorrect default permissions on the Windows installer's …
DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScript in the browser of an authenticated user who is tricked into visiting a craft…
A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user to execute arbitrary commands in the context of the Cribl Edge service account.
Cribl UI 1.5.0 allows remote attackers to run arbitrary commands via an unauthenticated web request.