CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

textproc/kibana94 9.4.7

Browser-based analytics and search interface to Elasticsearch (9.4.x version)

1
unaddressed
0
VuXML only
65
fixed
0
open problem reports

Port info

Maintainer
elastic@FreeBSD.org
Packages
latest: 9.4.7
Upstream
up to date
Last update
to 9.4.7 · df8b43588d
Quarterly
2026Q4: 9.4.7
WWW
https://www.elastic.co/products/kibana
Links
cgit · VuXML

Install

Package
# pkg install kibana94
installs 9.4.7 from latest; from quarterly (2026Q4) 9.4.7
Port
# cd /usr/ports/textproc/kibana94 && make install clean
Size
231 MiB download · 1.2 GiB installed
Depends on
devel/libuv 1.52.1, devel/re2 20251105, www/node24 24.21.0_3
License
APACHE20
Creates
user www, group www
pkg-message
Shown after installing
NOTICE: This port installs Kibana-specific utilities
as symbolic links into /usr/local/bin.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 169.4.79.4.7–
FreeBSD 159.4.79.4.7–
FreeBSD 149.4.79.4.79.4.7

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 159.4.79.4.7–
FreeBSD 149.4.79.4.79.4.7

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 9.4.7 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-1024126.52026-10-06Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authe…

VuXML only (0)

Listed in VuXML, the packaged version 9.4.7 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (65)

Show 65 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-1024068.82026-10-06Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sha…
CVE-2026-631378.32026-09-01Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user hol…
CVE-2026-785838.12026-09-03Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations origin…
CVE-2026-823028.12026-09-03Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAP…
CVE-2026-726658.12026-08-13Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality …
CVE-2026-726707.72026-08-13A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require th…
CVE-2026-726727.72026-08-13The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's intern…
CVE-2026-726697.62026-08-13The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not ve…
CVE-2026-726687.32026-09-26Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared …
CVE-2026-785907.32026-09-02Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged r…
CVE-2026-785927.32026-09-01Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path …
CVE-2026-726777.32026-08-13Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a use…
CVE-2026-726587.32026-08-13Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizatio…
CVE-2026-726757.12026-08-13Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machi…
CVE-2026-726327.12026-08-13Observable Discrepancy (CWE-203) in Kibana Fleet can lead to information disclosure via Excavation (CAPEC-116). Fleet removes the Elasticsearch API key value of an enrol…
CVE-2026-726437.12026-08-13Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the…
CVE-2026-726297.12026-08-13Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Constrained by …
CVE-2026-726307.12026-08-13Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration …
CVE-2026-726666.82026-08-13Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space …
CVE-2026-944006.52026-09-26Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)
CVE-2026-785826.52026-09-26Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An …
CVE-2026-822996.52026-09-03Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
CVE-2026-785996.52026-09-02Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal res…
CVE-2026-785866.52026-09-02Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with…
CVE-2026-786086.52026-09-01Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kib…
CVE-2026-726546.52026-09-01Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An operation a…
CVE-2026-726826.52026-09-01Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user hold…
CVE-2026-726286.52026-09-01Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Strea…
CVE-2026-726446.52026-09-01Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only the low-privileged fea…
CVE-2026-631386.52026-09-01Improper Neutralization of Special Elements in Data Query Logic (CWE-943) in Kibana can lead to information disclosure via NoSQL Injection (CAPEC-676). An authenticated …
CVE-2026-726806.52026-08-13Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier doe…
CVE-2026-726816.52026-08-13Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that…
CVE-2026-726746.52026-08-13Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of do…
CVE-2026-726766.52026-08-13Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPE…
CVE-2026-726676.52026-08-13Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted reques…
CVE-2026-726646.52026-08-13Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly…
CVE-2026-726636.52026-08-13Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expressi…
CVE-2026-726616.52026-08-13Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana d…
CVE-2026-726606.52026-08-13Uncaught Exception (CWE-248), resulting from Improper Input Validation (CWE-20), in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). An auth…
CVE-2026-726596.52026-08-13Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malform…
CVE-2026-726516.52026-08-13Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with r…
CVE-2026-726536.52026-08-13Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user who is…
CVE-2026-726316.52026-08-13Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally decla…
CVE-2026-490896.52026-08-13Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted …
CVE-2026-726626.32026-09-26Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality …
CVE-2026-785916.32026-09-02Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources vi…
CVE-2026-786015.52026-09-02Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity…
CVE-2026-785985.42026-09-02Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security…
CVE-2026-726415.42026-09-01Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An auth…
CVE-2026-726735.42026-08-13Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACL…
CVE-2026-1024104.32026-10-06Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surf…
CVE-2026-822984.32026-09-03Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
CVE-2026-785964.32026-09-03Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data vi…
CVE-2026-785954.32026-09-03Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Pr…
CVE-2026-785934.32026-09-03An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-…
CVE-2026-785844.32026-09-02Observable Response Discrepancy (CWE-204) in the Kibana Osquery feature can lead to information disclosure via Query System for Information (CAPEC-54). An authenticated …
CVE-2026-822934.32026-09-02Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Contr…
CVE-2026-786034.32026-09-01Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authent…
CVE-2026-785974.32026-09-01Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by A…
CVE-2026-726334.32026-09-01Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs (CAPE…
CVE-2026-726714.32026-08-13A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the pri…
CVE-2026-726504.32026-08-13Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAP…
CVE-2026-726554.32026-08-13Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management functionality of Elastic Security in Kibana can lead to u…
CVE-2026-490964.32026-08-13Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case comment was no…
CVE-2026-786064.22026-09-01Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained …

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (3)

Vladimir Druzenko (vvd) · 9.4.7
textproc/kibana94: Update 9.4.1 => 9.4.7

Changelogs:
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.2-release-notes
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.3-release-notes
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.4-release-notes
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.5-release-notes
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.6-release-notes
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.7-release-notes
https://github.com/nodejs/nan/blob/v2.29.0/CHANGELOG.md
https://github.com/uhop/node-re2/compare/1.24.1...1.26.1

PR:		297679
Approved by:	elastic (implicit, inactive for several months again)
Sponsored by:	UNIS Labs
df8b43588d
Vladimir Druzenko (vvd) · 9.4.1
textproc/kibana94: New port: Browser-based analytics and search interface to Elasticsearch 9.4.x

Release Notes:
https://www.elastic.co/docs/release-notes/kibana#kibana-9.4.1-release-notes

PR:		293746
Approved by:	girgen (elastic, maintainer)
Sponsored by:	UNIS Labs
73de92687c
Vladimir Druzenko (vvd) · 9.3.4
textproc/kibana94: Repocopy from textproc/kibana93

PR:		293746
Approved by:	girgen (elastic, maintainer)
Sponsored by:	UNIS Labs
61007b538b