# CVEs present in the latest version **URL:** \ **Category:** Elasticsearch\ **Created:** [May 9, 2023, 2:20pm UTC](https://discuss.elastic.co/t/cves-present-in-the-latest-version/332950 "2023-05-09T14:20:09Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![beltran-rubo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/beltran-rubo/32/120810_2.png) [@beltran-rubo](https://discuss.elastic.co/u/beltran-rubo)\ **Post date:** [May 9, 2023, 2:20pm UTC](https://discuss.elastic.co/t/cves-present-in-the-latest-version/332950/1 "2023-05-09T14:20:09Z")
In the latest release, at this moment 8.7.1, there are vulnerabilities in some jar files included. From Trivy scanner: CVE-2020-15522 CVE-2020-8908 CVE-2021-29425 CVE-2021-40690 CVE-2022-1471 CVE-2022-45146 CVE-2023-1370 Is there any upgrade policy for upgrading those jar files? Is there any assessment that concludes those are not critical for Elasticsearch? Thanks. ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [May 9, 2023, 3:03pm UTC](https://discuss.elastic.co/t/cves-present-in-the-latest-version/332950/2 "2023-05-09T15:03:18Z")
The process for reporting potential security vulnerabilities is [described on this page](https://www.elastic.co/community/security). Unfortunately we are unable to discuss potential security issues in public. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 6, 2023, 3:03pm UTC](https://discuss.elastic.co/t/cves-present-in-the-latest-version/332950/3 "2023-06-06T15:03:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.