Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-4838

Publication date:

26/03/2026

A flaw has been found in SourceCodester Malawi Online Market 1.0. The impacted element is an unknown function of the file /display.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

29/04/2026

CVE-2026-4075

Publication date:

26/03/2026

The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;baf_sbox&#39; shortcode in all versions up to and including 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as &#39;sbox_id&#39;, &#39;sbox_class&#39;, &#39;placeholder&#39;, &#39;highlight_color&#39;, &#39;highlight_bg&#39;, and &#39;cont_ext_class&#39;. These attributes are directly interpolated into HTML element attributes without any esc_attr() escaping in the baf_sbox() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-4335

Publication date:

26/03/2026

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versions up to, and including, 6.4.3. This is due to insufficient output escaping in the getEditorPopup() function and its corresponding media-popup.php template. Specifically, the attachment&#39;s post_title is retrieved from the database via get_post() in AjaxController.php (line 435) and passed directly to the view template (line 449), where it is rendered into an HTML input element&#39;s value attribute without esc_attr() escaping (media-popup.php line 139). Since WordPress allows Authors to set arbitrary attachment titles (including double-quote characters) via the REST API, a malicious author can craft an attachment title that breaks out of the HTML attribute and injects arbitrary JavaScript event handlers. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts that execute whenever a higher-privileged user (such as an administrator) opens the ShortPixel AI editor popup (Background Removal or Image Upscale) for the poisoned attachment.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-3328

Publication date:

26/03/2026

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the &#39;post_content&#39; of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress&#39;s `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-1986

Publication date:

26/03/2026

The FloristPress for Woo – Customize your eCommerce store for your Florist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the &#39;noresults&#39; parameter in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping on the user supplied &#39;noresults&#39; parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-4835

Publication date:

26/03/2026

A security vulnerability has been detected in code-projects Accounting System 1.0. Impacted is an unknown function of the file /my_account/add_costumer.php of the component Web Application Interface. Such manipulation of the argument costumer_name leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

Severity CVSS v4.0: LOW

Last modification:

29/04/2026

CVE-2026-4836

Publication date:

26/03/2026

A vulnerability was detected in code-projects Accounting System 1.0. The affected element is an unknown function of the file /my_account/delete.php. Performing a manipulation of the argument cos_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Severity CVSS v4.0: LOW

Last modification:

29/04/2026

CVE-2025-15101

Publication date:

26/03/2026

An OS command injection vulnerability in the web management interface of certain ASUS router models allows remote authenticated administrators to execute arbitrary system commands via a crafted parameter.<br /> Refer to the &#39;Security Update for ASUS Router Firmware&#39; section on the ASUS Security Advisory for more information.

Severity CVSS v4.0: HIGH

Last modification:

13/05/2026

CVE-2014-125112

Publication date:

26/03/2026

Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.<br /> <br /> Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of the cookie data, when there is no secret used to sign the cookie.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2026

CVE-2026-4831

Publication date:

26/03/2026

A security flaw has been discovered in kalcaddle kodbox 1.64. Impacted is the function can of the file /workspace/source-code/app/controller/explorer/auth.class.php of the component Password-protected Share Handler. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: LOW

Last modification:

29/04/2026

CVE-2026-4833

Publication date:

26/03/2026

A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project maintainer confirms: "[I]f you feed it an infinitely deep blockquote input it will crash. (...) [T]his is a duplicate of an old bug that I&#39;ve been working on."

Severity CVSS v4.0: LOW

Last modification:

29/04/2026

CVE-2026-4484

Publication date:

26/03/2026

The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the &#39;InstructorsController::prepare_object_for_database&#39; function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

Subscribe to Vulnerabilities