Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-63360

Publication date:

26/08/2026

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding. This issue affects LimeSurvey: 7.0.5.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-64632

Publication date:

26/08/2026

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-65641

Publication date:

26/08/2026

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

Severity CVSS v4.0: CRITICAL

Last modification:

26/08/2026

CVE-2026-65642

Publication date:

26/08/2026

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers&#39; databases.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-43621

Publication date:

26/08/2026

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-45694

Publication date:

26/08/2026

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. The parameters are placed into the page title with only strip_tags applied, and the title is then written into an inline document.title assignment through string interpolation, so a single quote terminates the JavaScript string and the remaining input runs as script. An attacker who lures an authenticated user into following a crafted link can execute script in that user&#39;s session, enabling actions such as theft of session data. This issue is fixed in version 26.5.0.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2026

CVE-2026-55182

Publication date:

26/08/2026

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an alert transport entry are insufficiently escaped before being passed to an exec call. An authenticated administrator can craft a transport entry whose Recipient contains shell metacharacters and whose path points to the bundled composer_wrapper.php script, which itself passes attacker-controlled input to further unsafe exec calls. By chaining these calls, the administrator can execute arbitrary operating-system commands on the LibreNMS host. This issue is fixed in version 26.5.0.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-16809

Publication date:

26/08/2026

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-21809

Publication date:

26/08/2026

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2026

CVE-2026-21810

Publication date:

26/08/2026

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2026

CVE-2026-75411

Publication date:

26/08/2026

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2026

CVE-2026-75413

Publication date:

26/08/2026

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2026

Subscribe to Vulnerabilities