Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-34242

Publication date:

15/04/2026

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn&#39;t verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2026

CVE-2026-33440

Publication date:

15/04/2026

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn&#39;t restrict possible redirects. This issue has been fixed in version 5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2026

CVE-2026-33435

Publication date:

15/04/2026

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn&#39;t filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2026

CVE-2026-33220

Publication date:

15/04/2026

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn&#39;t perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2026

CVE-2026-6290

Publication date:

15/04/2026

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user&#39;s current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a notebook cell, to run VQL queries on other orgs which they may not have access to. The user&#39;s permissions in the other org are<br /> the same as the permissions they have in the org containing the notebook.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2026

CVE-2026-5758

Publication date:

15/04/2026

JavaScript is vulnerable to prototype pollution in Mafintosh&#39;s protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2026

CVE-2026-33214

Publication date:

15/04/2026

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn&#39;t enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2026

CVE-2026-33212

Publication date:

15/04/2026

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn&#39;t verify user access for pending tasks. This could expose logs of in-progress operations to users who don&#39;t have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.

Severity CVSS v4.0: Pending analysis

Last modification:

21/04/2026

CVE-2026-32631

Publication date:

15/04/2026

Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user&#39;s NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction. By brute-forcing the NTLMv2 hash (which is expensive, but possible), credentials can be extracted. This issue has been fixed in version 2.53.0.windows.3.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2026

CVE-2026-30993

Publication date:

15/04/2026

Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2026

CVE-2026-6370

Publication date:

15/04/2026

Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.

Severity CVSS v4.0: Pending analysis

Last modification:

22/04/2026

CVE-2026-6372

Publication date:

15/04/2026

Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept Cryptocurrencies with Plisio: from n/a through 2.0.5.

Severity CVSS v4.0: Pending analysis

Last modification:

22/04/2026

Subscribe to Vulnerabilities