Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-19085

Publication date:

21/08/2026

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user&#39;s password-protected post as publicly readable.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-19435

Publication date:

21/08/2026

The Duplicate Post WordPress plugin before 1.5.6 does not check the user&#39;s capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users&#39; private and draft content.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-75796

Publication date:

21/08/2026

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator&#39;s.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-13736

Publication date:

21/08/2026

The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-14325

Publication date:

21/08/2026

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-14601

Publication date:

21/08/2026

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-16575

Publication date:

21/08/2026

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict access to per-vendor commission configuration returned by one of its unauthenticated store REST endpoints, allowing any unauthenticated user to disclose a vendor&#39;s commission type and, when category-based commission is configured, the per-category and default commission rates.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-16576

Publication date:

21/08/2026

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Managers to install and activate arbitrary Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 from WordPress.org.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-16577

Publication date:

21/08/2026

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor&#39;s actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-16959

Publication date:

21/08/2026

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2025-15671

Publication date:

21/08/2026

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member&#39;s session and take over their customer account after the victim logs in through an attacker-crafted request.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

CVE-2026-65645

Publication date:

21/08/2026

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList and getThreadMessages accept rid / tmid as raw, untyped parameters with no schema validation. A MongoDB operator object (e.g. {"$gt": "4"}) can be substituted for a string room-id or message-id. The authorization check resolves to a room the attacker already has access to, while the downstream data query fans out across all rooms - disclosing private thread parents and their full reply content to any low-privilege authenticated user.<br /> The REST route chat.getThreadsList was patched in v5.0 (HackerOne report #1446767) by adding rid: {type:&#39;string&#39;} AJV validation. The equivalent DDP method was never given the same fix and remains exploitable

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2026

Subscribe to Vulnerabilities