Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-26725
Publication date:
20/02/2026
An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 allows a remote attacker to escalate privileges via the AccessID parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2026-26745
Publication date:
20/02/2026
OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2026-26746
Publication date:
20/02/2026
OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with the file upload functionality to achieve Remote Code Execution (RCE).
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2026-26095
Publication date:
20/02/2026
Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.
Severity CVSS v4.0: HIGH
Last modification:
20/02/2026

CVE-2026-26096
Publication date:
20/02/2026
Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.
Severity CVSS v4.0: HIGH
Last modification:
20/02/2026

CVE-2026-26097
Publication date:
20/02/2026
Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.
Severity CVSS v4.0: HIGH
Last modification:
20/02/2026

CVE-2026-26098
Publication date:
20/02/2026
Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.
Severity CVSS v4.0: HIGH
Last modification:
20/02/2026

CVE-2026-26099
Publication date:
20/02/2026
Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.
Severity CVSS v4.0: HIGH
Last modification:
20/02/2026

CVE-2026-26100
Publication date:
20/02/2026
Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.
Severity CVSS v4.0: MEDIUM
Last modification:
20/02/2026

CVE-2026-26101
Publication date:
20/02/2026
Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.
Severity CVSS v4.0: HIGH
Last modification:
20/02/2026

CVE-2026-25715
Publication date:
20/02/2026
The web management interface of the device allows the administrator <br /> username and password to be set to blank values. Once applied, the <br /> device permits authentication with empty credentials over the web <br /> management interface and Telnet service. This effectively disables <br /> authentication across all critical management channels, allowing any <br /> network-adjacent attacker to gain full administrative control without <br /> credentials.
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026

CVE-2026-26048
Publication date:
20/02/2026
The Wi-Fi router is vulnerable to de-authentication attacks due to the <br /> absence of management frame protection, allowing forged deauthentication<br /> and disassociation frames to be broadcast without authentication or <br /> encryption. An attacker can use this to cause unauthorized disruptions <br /> and create a denial-of-service condition.
Severity CVSS v4.0: Pending analysis
Last modification:
20/02/2026
Subscribe to Vulnerabilities