Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-58153
Publication date:
29/07/2026
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1.<br /> <br /> This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.<br /> <br /> Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Severity CVSS v4.0: MEDIUM
Last modification:
29/07/2026

CVE-2026-11973
Publication date:
29/07/2026
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the &amp;#39;orderby&amp;#39; parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity CVSS v4.0: Pending analysis
Last modification:
29/07/2026

CVE-2026-33930
Publication date:
29/07/2026
Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled.<br /> <br /> This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.<br /> <br /> Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Severity CVSS v4.0: HIGH
Last modification:
29/07/2026

CVE-2026-57834
Publication date:
29/07/2026
Apache Traffic Server allows request smuggling if chunked messages are malformed.<br /> <br /> This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.<br /> <br /> Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Severity CVSS v4.0: HIGH
Last modification:
29/07/2026

CVE-2026-41920
Publication date:
29/07/2026
Improper Access Control vulnerability in Apache Traffic Server.<br /> <br /> This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.<br /> <br /> Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
Severity CVSS v4.0: HIGH
Last modification:
29/07/2026

CVE-2026-58150
Publication date:
29/07/2026
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.<br /> <br /> This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.<br /> <br /> Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Severity CVSS v4.0: HIGH
Last modification:
29/07/2026

CVE-2026-35226
Publication date:
29/07/2026
An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malformed PROFINET communication data that triggers an exception in the affected PLC application. The exception is handled by the CODESYS Control runtime system and results in a controlled stop of the PLC application.
Severity CVSS v4.0: HIGH
Last modification:
29/07/2026

CVE-2026-18191
Publication date:
29/07/2026
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.
Severity CVSS v4.0: CRITICAL
Last modification:
29/07/2026

CVE-2026-18192
Publication date:
29/07/2026
VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
Severity CVSS v4.0: HIGH
Last modification:
29/07/2026

CVE-2026-18197
Publication date:
29/07/2026
Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in Link Library allows Cross-Site Scripting (XSS).<br /> <br /> This issue affects Link Library: before 7.9.4.
Severity CVSS v4.0: MEDIUM
Last modification:
29/07/2026

CVE-2026-24033
Publication date:
29/07/2026
Inconsistent Interpretation of HTTP Requests (&amp;#39;HTTP Request/Response Smuggling&amp;#39;) vulnerability in Apache Traffic Server.<br /> <br /> This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14.<br /> <br /> Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Severity CVSS v4.0: MEDIUM
Last modification:
29/07/2026

CVE-2026-22068
Publication date:
29/07/2026
Regular Expression without Anchors vulnerability in Apache Traffic Server.<br /> <br /> This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.<br /> <br /> Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Severity CVSS v4.0: MEDIUM
Last modification:
29/07/2026
Subscribe to Vulnerabilities