Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-11920
Publication date:
05/08/2026
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The affected admin page lacks nonce or CSRF protection on the GET request, meaning an unauthenticated attacker could exploit this vulnerability by tricking an authenticated administrator into issuing a crafted request. Additionally, the vulnerability is only triggered when the 'orderby' parameter is also present and non-empty alongside the 'order' parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2026

CVE-2026-11454
Publication date:
05/08/2026
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/ REST endpoint. The endpoint's permission callback checks only the role-level view_contacts capability and read_single() returns the full contact record by sequential integer ID without the object-level view_contact ownership check applied elsewhere in the codebase. This makes it possible for authenticated attackers holding view_contacts but not view_others_contacts — notably Groundhogg's built-in Sales Rep role, designed to see only its own contacts — to read any contact record on the site, including PII, contact meta, owner IDs, the admin edit URL, and (for contacts linked to a WordPress user) that user's full capability set.
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2026

CVE-2026-71201
Publication date:
05/08/2026
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2026

CVE-2026-68077
Publication date:
05/08/2026
An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service.<br /> <br /> This issue affects Apache Qpid Broker-J: through 10.0.1.<br /> <br /> Users are recommended to upgrade to version 10.1.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
06/08/2026

CVE-2026-68075
Publication date:
05/08/2026
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.<br /> <br /> This issue affects Apache Qpid Broker-J: through 10.0.1.<br /> <br /> Users are recommended to upgrade to version 10.1.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
06/08/2026

CVE-2026-68080
Publication date:
05/08/2026
It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.<br /> <br /> This issue affects Apache Qpid Broker-J: through 10.0.1.<br /> <br /> Users are recommended to upgrade to version 10.1.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
06/08/2026

CVE-2026-68078
Publication date:
05/08/2026
It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.<br /> <br /> This issue affects Apache Qpid Broker-J: through 10.0.1.<br /> <br /> Users are recommended to upgrade to version 10.1.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
06/08/2026

CVE-2026-70374
Publication date:
05/08/2026
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as &amp;#39;thumbnail&amp;#39; + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec (&amp;#39;convert &amp;#39; + tempFile + ...).
Severity CVSS v4.0: Pending analysis
Last modification:
10/08/2026

CVE-2026-70375
Publication date:
05/08/2026
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.
Severity CVSS v4.0: Pending analysis
Last modification:
10/08/2026

CVE-2026-68073
Publication date:
05/08/2026
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.<br /> <br /> This issue affects Apache Qpid Broker-J: through 10.0.1.<br /> <br /> Users are recommended to upgrade to version 10.1.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
06/08/2026

CVE-2026-67552
Publication date:
05/08/2026
A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.<br /> <br /> This issue affects Apache Qpid Proton-Dotnet through 1.0.0.<br /> <br /> Users are recommended to upgrade to version 1.1.0, which fixes the issue
Severity CVSS v4.0: Pending analysis
Last modification:
07/08/2026

CVE-2026-67553
Publication date:
05/08/2026
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service.<br /> <br /> This issue affects Apache Qpid Proton-Dotnet: through 1.0.0.<br /> <br /> Users are recommended to upgrade to version 1.1.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
07/08/2026
Subscribe to Vulnerabilities