CVE Vulnerability Catalog

CVE-2026-56148 in Elasticsearch involves uncontrolled recursion leading to denial of service. An authenticated user can submit a specially crafted query causing excessive resource consumption during processing, potentially rendering the affected node unavailable.

CVE-2026-49088 in Kibana allows insertion of sensitive information into log files. When optional APM instrumentation is enabled, sensitive request header values may be recorded in application logs.

CWE-770 vulnerability in Kibana allows a denial of service via excessive resource allocation. An authenticated attacker can send a crafted bulk deletion request, exhausting resources and making Kibana unavailable.

A vulnerability in the Guardian language-system fails to sanitize the 'id' GET parameter before inserting it into HTML source and form action attributes in media.php (lines 119, 129). An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.

The vulnerability in the Guardian language-system is due to the lack of sanitization of the GET parameter 'id' before inserting it into HTML form action attributes in text_file.php. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session.

An XSS vulnerability in the Guardian language-system fails to sanitize the 'name' GET parameter before outputting it into an HTML input value attribute in designer.php (line 57). An authenticated attacker can craft a URL containing script tags that execute in the victim's browser session.

The Webba Booking WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 6.4.13.

The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with the 'Service' or 'Admin' role.

A vulnerability in Keras versions up to and including 3.13.2 allows arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The issue stems from missing checks of the `dataset.is_virtual` property in `H5IOStore._verify_dataset()` and `file_editor.py` methods. An attacker can craft a malicious `.keras` model or `.h5` weights file with a Virtual Dataset (VDS) referencing external HDF5 files.

A vulnerability in Stormshield Network Security allows authentication using a revoked client certificate on the captive-admin portal. An attacker possessing such a certificate can gain administrative access.

Cross-site scripting (XSS) vulnerability in the Timeline extension for MediaWiki allows an attacker to inject malicious JavaScript due to improper input neutralization during page generation. The issue affects includes/Timeline.php and scripts/EasyTimeline.pl.

A Cross-site Scripting (XSS) vulnerability was found in MediaWiki due to improper input neutralization during page generation. It affects multiple source files including Language.php and various log formatters.

A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information. The issue is located in the includes/Actions/InfoAction.php file.

A cross-site scripting (XSS) vulnerability exists in MediaWiki before versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9 in the file resources/src/mediawiki.Api/index.js. Improper input neutralization during web page generation allows injection of malicious scripts.

An XSS vulnerability in the SyntaxHighlight_GeSHi MediaWiki extension allows an attacker to inject malicious scripts due to improper input neutralization. The issue affects the includes/SyntaxHighlight.php file and versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9.

A vulnerability in MediaWiki allows unauthorized access to authentication and account management functions. The issue affects API files and special pages responsible for changing, linking, and removing authentication data.

An XSS vulnerability in MediaWiki and CentralAuth allows an attacker to inject malicious scripts into a web page generated by the application. The issue affects several source files including ApiFormatBase.php and ApiHelp.php.

A vulnerability in the Wikimedia Foundation AbuseFilter extension allows an unauthorized actor to access sensitive information. The issue is located in the file includes/Api/QueryAbuseFilters.php.

A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information. The issue is located in the includes/Parser/Parser.php file and affects versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9.

A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information via the includes/Api/ApiUserrights.php file. The issue affects versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9.