Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-49196

Publication date:

29/05/2026

The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands.

Severity CVSS v4.0: HIGH

Last modification:

29/05/2026

CVE-2026-49197

Publication date:

29/05/2026

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.

Severity CVSS v4.0: CRITICAL

Last modification:

29/05/2026

CVE-2026-10057

Publication date:

29/05/2026

ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistent JavaScript codes that are executed in users&#39; browsers upon page load.

Severity CVSS v4.0: MEDIUM

Last modification:

29/05/2026

CVE-2026-10058

Publication date:

29/05/2026

Severity CVSS v4.0: MEDIUM

Last modification:

29/05/2026

CVE-2026-10039

Publication date:

29/05/2026

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the &#39;order&#39; parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that the attacker also supply a valid &#39;orderby&#39; parameter in the same request, as this is necessary to reach the vulnerable code path that processes and concatenates the &#39;order&#39; value into the SQL query.

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2026

CVE-2026-49322

Publication date:

29/05/2026

Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a single PIN authentication exchange. The Infotainment Digital Round display computes its response using a non-cryptographic operation rather than a cryptographic challenge-response, so the PIN is mathematically derivable from one captured exchange, defeating the motorcycle&#39;s primary user-authentication control. Specific protocol details have been withheld pending vendor remediation.

Severity CVSS v4.0: MEDIUM

Last modification:

29/05/2026

CVE-2026-4776

Publication date:

29/05/2026

An SQL injection vulnerability exists in Mautic&#39;s API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2026

CVE-2026-9243

Publication date:

29/05/2026

The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;carousel_direction&#39; parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2026

CVE-2026-3655

Publication date:

29/05/2026

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared against the victim&#39;s stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim&#39;s phone number in the same request.

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2026

CVE-2025-11262

Publication date:

29/05/2026

The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2026

CVE-2026-6324

Publication date:

29/05/2026

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server. Successful exploitation can allow an attacker to bypass security controls, poison web caches, or gain unauthorized access.

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2026

CVE-2025-14042

Publication date:

29/05/2026

The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;Project Details&#39; custom field in Portfolio Items in all versions up to, and including, 13.4.1. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the &#39;project_details&#39; custom field. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

29/05/2026

Subscribe to Vulnerabilities