CVE-2026-4799Medium· 4.3▾ SunlitIn Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.
flx < 4.1.0Upgrade past the affected range:
flx 4.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4819Medium· 4.9In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.
CVE-2026-4818Medium· 6.8In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.
CVE-2024-0953Medium· 6.1When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code
CVE-2026-34442Medium· 5.4FreeScout is a free help desk and shared inbox built with PHP's Laravel framework
CVE-2025-3155High· 7.4A flaw was found in Yelp
CVE-2023-6291High· 7.1A flaw was found in the redirect_uri validation logic in Keycloak