Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-101166

Publication date:

04/11/2026

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product&#39;s publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-104719

Publication date:

04/11/2026

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-105191

Publication date:

04/11/2026

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users&#39; sensitive HR, CRM and Accounting data by enumerating record identifiers.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-105413

Publication date:

04/11/2026

The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-106000

Publication date:

04/11/2026

The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-106649

Publication date:

04/11/2026

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-108041

Publication date:

04/11/2026

The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-101165

Publication date:

04/11/2026

The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order&#39;s payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order&#39;s total before completing payment.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2025-11229

Publication date:

04/11/2026

The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended access controls.<br /> <br /> Exploitation of this vulnerability can lead to privilege escalation, enabling unprivileged clients to perform unauthorized administrative actions, access confidential organizational data, and potentially achieve full account takeover in deployments where the `authorize_all_scopes` configuration deviates from its default disabled state.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-105296

Publication date:

04/11/2026

Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed.

Severity CVSS v4.0: MEDIUM

Last modification:

04/11/2026

CVE-2026-79405

Publication date:

04/11/2026

In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration. This could lead to remote denial of service with no additional execution privileges needed.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

CVE-2026-80335

Publication date:

04/11/2026

In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset variable during firmware update sessions. This could lead to heap memory corruption, system crash, or potential arbitrary code execution with no additional execution privileges needed.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2026

Subscribe to Vulnerabilities