2026

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 an

SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forgin

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (C

containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that

Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control S

Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to a

Incorrect Authorization (CWE-863) in Elastic Defend can lead to unauthorized information disclosure via Accessing Functi

Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An

Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Exces

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Exce

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130).

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and

Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the option

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive A

Guardian language-system passes the id GET parameter directly into a PHP exec() call in text_to_subtitles.php (line 19)

Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe.php (line 15) without

Guardian language-system passes the id GET parameter directly into a PHP exec() call in transcribe_amazon.php (line 15)

Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate_text.php (line 18) wit

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech_text.php (line 18) withou

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac.php (line 18) without

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speechmac_text.php (line 18) wit

Guardian language-system passes the id GET parameter directly into a PHP exec() call in complex_start.php (line 14) with

Guardian language-system passes the id GET parameter directly into a PHP exec() call in speech.php (line 18) without san

Guardian language-system passes the id GET parameter directly into a PHP exec() call in text.php (line 15) without sanit

Guardian language-system passes the id GET parameter directly into a PHP exec() call in translate.php (line 14) without

Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line

Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124)

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16):

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17):

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELE

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): S

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action att

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attri

Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML input value attribut

Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Contr

A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a Do

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cau

A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS co

A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS c