CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.22)
CVE-2026-49088 in Kibana allows insertion of sensitive information into log files. When optional APM instrumentation is enabled, sensitive request header values may be recorded in application logs.
CWE-770 vulnerability in Kibana allows a denial of service via excessive resource allocation. An authenticated attacker can send a crafted bulk deletion request, exhausting resources and making Kibana unavailable.
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the id parameter passed to the exec() function in text_to_subtitles.php.
A vulnerability in the Guardian language system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the 'id' parameter in transcribe.php. The parameter is passed directly to the PHP exec() function without any sanitization.
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the 'id' parameter passed to the PHP exec() function in transcribe_amazon.php.
The vulnerability in the Guardian language system involves passing the 'id' GET parameter directly into a PHP exec() call in translate_text.php without sanitization. No authentication is required, allowing an unauthenticated remote attacker to execute arbitrary OS commands.
A vulnerability in the Guardian language-system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the id parameter in speech_text.php.
A vulnerability in the Guardian language-system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' parameter passed directly to the PHP exec() function in speechmac.php.
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the id parameter, which is passed unsanitized to the PHP exec() function in speechmac_text.php. No authentication is required for exploitation.
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the 'id' parameter in complex_start.php. The lack of input validation and direct use of exec() without sanitization enables full server compromise.
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' GET parameter passed directly to the PHP exec() function in speech.php.
A vulnerability in the Guardian language-system allows an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the id parameter, which is passed unsanitized to the exec() function in text.php.
A vulnerability in the Guardian language-system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' parameter in translate.php.
A vulnerability in the Guardian language system allows an unauthenticated attacker to execute arbitrary OS commands remotely by injecting shell metacharacters into the 'id' parameter in subtitles.php. The parameter is passed directly to the PHP exec() function without any sanitization.
SQL Injection vulnerability in Guardian language-system allows an authenticated attacker to inject SQL code via the id parameter in translate_text.php. Lack of input sanitization enables extraction of database contents.
An SQL injection vulnerability in Guardian language-system allows an authenticated attacker to inject malicious SQL via the 'name' GET parameter in designer.php. Unsanitized input enables arbitrary SQL execution and extraction of database contents.
An SQL injection vulnerability in the Guardian language-system allows an authenticated attacker to inject malicious SQL code via the GET parameter 'id' in subtitles.php. Lack of input sanitization enables error-based SQL injection to extract database contents.
An SQL injection vulnerability in Guardian language-system allows an authenticated attacker to inject malicious SQL via the 'id' parameter in job_info_get.php. Unsanitized input enables error-based SQL injection to extract database contents.
An SQL injection vulnerability in the Guardian language-system component allows an authenticated attacker to inject malicious SQL code via the 'id' parameter in text_file.php. Lack of input sanitization enables extraction of database contents.
An SQL injection vulnerability in Guardian language-system allows an authenticated attacker to inject malicious SQL via the id parameter in media.php. Lack of input sanitization enables error-based extraction of database contents.