Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-21553
Publication date:
03/08/2026
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2026

CVE-2026-28147
Publication date:
03/08/2026
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels.<br /> <br /> This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.15.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2026

CVE-2026-21550
Publication date:
03/08/2026
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2026

CVE-2026-21551
Publication date:
03/08/2026
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2026

CVE-2026-21552
Publication date:
03/08/2026
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2026

CVE-2026-21548
Publication date:
03/08/2026
In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System execution privileges needed.
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2026

CVE-2026-21549
Publication date:
03/08/2026
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2026

CVE-2026-18592
Publication date:
03/08/2026
A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument email_templates_key results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: LOW
Last modification:
12/08/2026

CVE-2026-18593
Publication date:
03/08/2026
A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: LOW
Last modification:
12/08/2026

CVE-2026-18590
Publication date:
03/08/2026
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity CVSS v4.0: LOW
Last modification:
12/08/2026

CVE-2026-18591
Publication date:
03/08/2026
A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Severity CVSS v4.0: LOW
Last modification:
12/08/2026

CVE-2026-12259
Publication date:
03/08/2026
In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications.
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2026
Subscribe to Vulnerabilities