Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-2445
Publication date:
20/07/2026
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.<br /> <br /> An attacker can leverage this vulnerability to cause the user&amp;#39;s browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-16242
Publication date:
20/07/2026
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-13577
Publication date:
20/07/2026
Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable.<br /> <br /> Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable.<br /> <br /> The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function).<br /> <br /> These are all low-entropy and easily guessed sources.<br /> <br /> The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications.<br /> <br /> Predictable session ids could allow an attacker to gain access to systems.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-6656
Publication date:
20/07/2026
Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks.<br /> <br /> The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-8825
Publication date:
20/07/2026
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-9833
Publication date:
20/07/2026
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-16235
Publication date:
20/07/2026
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts.<br /> <br /> These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-12898
Publication date:
20/07/2026
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-12970
Publication date:
20/07/2026
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-12972
Publication date:
20/07/2026
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-12973
Publication date:
20/07/2026
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-13142
Publication date:
20/07/2026
The Social Login, Passkeys, Magic Link &amp; Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026
Subscribe to Vulnerabilities