Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-66691

Publication date:
13/08/2026
Unauthenticated Broken Access Control in Nokri
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66693

Publication date:
13/08/2026
Subscriber Broken Access Control in Motors
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66697

Publication date:
13/08/2026
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66698

Publication date:
13/08/2026
Unauthenticated Cross Site Scripting (XSS) in SureDash
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66700

Publication date:
13/08/2026
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66654

Publication date:
13/08/2026
Subscriber Server Side Request Forgery (SSRF) in Vehica Core
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66655

Publication date:
13/08/2026
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66656

Publication date:
13/08/2026
Unauthenticated Local File Inclusion in Foton Core
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66657

Publication date:
13/08/2026
Unauthenticated Local File Inclusion in Biagiotti Core
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66658

Publication date:
13/08/2026
Subscriber SQL Injection in Reviewer
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66660

Publication date:
13/08/2026
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026

CVE-2026-66661

Publication date:
13/08/2026
Subscriber Privilege Escalation in Directories Pro
Severity CVSS v4.0: Pending analysis
Last modification:
14/08/2026