Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-7529

Publication date:

05/08/2026

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => &#39;__return_true&#39;` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin&#39;s banner, stockbar, and core settings — including saving/updating banner records, toggling stockbar/feature flags, changing the active banner, and uploading background-image files via wp_handle_upload() — without any nonce or capability check.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2026

CVE-2026-7456

Publication date:

05/08/2026

The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function in all versions up to, and including, 3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin&#39;s six configuration options — including the API key, connected Udimi user email, and tracking-script payload — effectively disconnecting the site from the configured Udimi account. The companion `ajax_connect()` handler is missing the same checks, allowing the same low-privilege attackers to overwrite those options with an attacker-supplied API key.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2026

CVE-2026-67623

Publication date:

05/08/2026

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository&#39;s .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to achieve arbitrary command execution with the victim&#39;s full privileges when any vibe command is run inside that repository.

Severity CVSS v4.0: HIGH

Last modification:

06/08/2026

CVE-2026-17506

Publication date:

05/08/2026

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and including, 2.15.0. This is due to the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries — a sequence that allows percent-encoded HTML to pass URL validation and then be reconstructed as raw markup, which wp_kses_post() does not strip because it retains img elements and data-* attributes, and because the public REST endpoint /iawp/search accepts unauthenticated requests as long as they carry a signature that is itself embedded in public page HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2026

CVE-2026-16443

Publication date:

05/08/2026

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2026

CVE-2026-15979

Publication date:

05/08/2026

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the &#39;img_file&#39; field within the cegg_data post metadata: the value passes only through wp_strip_all_tags() (which does not strip path traversal sequences), is stored directly in post meta, and is later concatenated without normalization into a filesystem path in getFullImgPath() before being passed to PHP&#39;s unlink(). This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the affected site&#39;s server which may make remote code execution possible.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2026

CVE-2025-70962

Publication date:

05/08/2026

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage.

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2026

CVE-2026-71293

Publication date:

05/08/2026

Statamic CMS&#39;s user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user&#39;s raw two-factor recovery codes with no access restriction.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2026

CVE-2026-71294

Publication date:

05/08/2026

Cotonti CMS&#39;s Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restriction, reachable by any member with write access to comments (the default setting in plugins/comments/comments.setup.php).

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2026

CVE-2026-71284

Publication date:

05/08/2026

Fledge&#39;s backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member&#39;s filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2026

CVE-2026-71285

Publication date:

05/08/2026

Uptime Kuma&#39;s Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/ page, enabling session-cookie theft and full page takeover.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2026

CVE-2026-71286

Publication date:

05/08/2026

The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer&#39;s compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input.

Severity CVSS v4.0: Pending analysis

Last modification:

10/08/2026

Subscribe to Vulnerabilities