Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-69155
Publication date:
02/07/2026
Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2025-69134
Publication date:
02/07/2026
Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2025-69152
Publication date:
02/07/2026
Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2025-69094
Publication date:
02/07/2026
Subscriber SQL Injection in Unicamp
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2025-69153
Publication date:
02/07/2026
Unauthenticated Cross Site Scripting (XSS) in Trendy Travel
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2025-69154
Publication date:
02/07/2026
Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2025-66076
Publication date:
02/07/2026
Unauthenticated Broken Access Control in Woostify Sites Library
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2025-58902
Publication date:
02/07/2026
Unauthenticated Local File Inclusion in Lighthouse
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2026-54431
Publication date:
02/07/2026
In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header.<br /> <br /> This issue was fixed in version 2.3.0
Severity CVSS v4.0: MEDIUM
Last modification:
02/07/2026

CVE-2026-54430
Publication date:
02/07/2026
liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT<br /> header. If signer matches the configured ARN, kid is appended to<br /> alb_base_url without URL encoding or path sanitization, and the HTTP GET<br /> is issued before signature verification. This allows an attacker to force<br /> the server to send a GET request to an attacker-chosen internal path.<br /> <br /> This issue was fixed in version 2.3.0
Severity CVSS v4.0: MEDIUM
Last modification:
02/07/2026

CVE-2026-9834
Publication date:
02/07/2026
The WP Database Backup – Unlimited Database &amp; Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST[&amp;#39;wp_db_exclude_table&amp;#39;]` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/admin/class-wpdb-admin.php` without wrapping them in `escapeshellarg()`—every other argument in the same command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the exclude-table values the sole exception—and because the only applied filtering, `sanitize_text_field()` via `recursive_sanitize_text_field()`, strips HTML tags but leaves shell metacharacters such as `;`, `|`, `` ` ``, and `$()` intact. This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary operating system commands on the server, potentially enabling full remote code execution. The injection is stored: malicious values submitted through the plugin settings form are persisted to the WordPress options table via `update_option(&amp;#39;wp_db_exclude_table&amp;#39;)` and later retrieved with `get_option()` and passed unsanitized to `shell_exec()` whenever a backup operation runs.
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026

CVE-2026-9145
Publication date:
02/07/2026
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro&amp;#39;s Form_Record object for upload-type fields and passes it directly to PHP&amp;#39;s copy() without validating that the value corresponds to a legitimately uploaded file — when no file is present in $_FILES, raw_value reflects the attacker-controlled POST string. copy() accepts both local filesystem paths and URL sources, so the attacker can target any file readable by the PHP process or supply an attacker-controlled remote URL. Elementor Pro is a prerequisite for triggering the code path (it owns the elementor_pro/forms/new_record hook and populates the Form_Record object), but the bug itself is entirely in Contact Form Entries&amp;#39; handler. This could allow unauthenticated attackers to disclose arbitrary files on the affected site&amp;#39;s server. The file is copied to a directory unknown to the attacker; the hashed directory name provides defense-in-depth but is generated from non-cryptographic sources (uniqid() + rand()) and should not be relied upon as the primary mitigation.
Severity CVSS v4.0: Pending analysis
Last modification:
02/07/2026
Subscribe to Vulnerabilities