Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-37227

Publication date:

16/05/2026

HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution.

Severity CVSS v4.0: HIGH

Last modification:

16/05/2026

CVE-2026-46719

Publication date:

16/05/2026

Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections.<br /> <br /> The metric names were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2026

CVE-2025-4202

Publication date:

16/05/2026

The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the &#39;cf_add_comment&#39; function in all versions up to, and including, 5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to arbitrary collaborations.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2026

CVE-2026-8656

Publication date:

16/05/2026

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON values and property names. If an application compares untrusted JSON/object data and renders annotated formatter output in the DOM, attacker-controlled HTML can be interpreted by the browser, resulting in XSS.

Severity CVSS v4.0: LOW

Last modification:

16/05/2026

CVE-2026-8657

Publication date:

16/05/2026

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.

Severity CVSS v4.0: HIGH

Last modification:

16/05/2026

CVE-2026-8681

Publication date:

16/05/2026

The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset all plugin configuration settings — including general settings, display rules, custom CSS, and WooCommerce tab settings — to their defaults by sending a POST request with ecs_reset_settings=1.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2026

CVE-2026-8704

Publication date:

15/05/2026

Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2026

CVE-2026-8700

Publication date:

15/05/2026

Crypt::DSA versions before 1.20 for Perl generate seeds using rand.<br /> <br /> Seeds were generated using Perl&#39;s built-in rand function, which is predictable and unsuitable for security usage.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2026

CVE-2026-45666

Publication date:

15/05/2026

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.11, the API /api/v1/notes/{note_id} endpoint lacks proper authorization checks, allowing authenticated users to retrieve notes belonging to other users by guessing or enumerating UUIDs. This results in unauthorized disclosure of potentially sensitive or private user data. This vulnerability is fixed in 0.8.11.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2026

CVE-2026-45667

Publication date:

15/05/2026

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, GET /api/v1/memories/ef is accessible without authentication and executes request.app.state.EMBEDDING_FUNCTION(...). This allows any unauthenticated caller to trigger embedding generation which can lead to direct cost exposure if a paid provider is used. This vulnerability is fixed in 0.8.0.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2026

CVE-2026-45346

Publication date:

15/05/2026

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31.

Severity CVSS v4.0: MEDIUM

Last modification:

15/05/2026

CVE-2026-45347

Publication date:

15/05/2026

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.11, there is a blind server side request forgery (SSRF) via the PDF generate function. In the PDF export, user inputs are interpreted as HTML and embedded into the PDF. According to tests, scripts and some potentially dangerous tags (iFrame, Object, etc.) are blocked, preventing server-side content from being read through this vulnerability. However, an image tag can be used to force a server-side request (SSRF), as shown in the following below. This vulnerability is fixed in 0.5.11.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2026

Subscribe to Vulnerabilities