Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-6656
Publication date:
20/07/2026
Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks.<br /> <br /> The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-8825
Publication date:
20/07/2026
The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, private pages and drafts authored by other users (including administrators).
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-9833
Publication date:
20/07/2026
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into following a crafted link.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-16235
Publication date:
20/07/2026
Crypt::Password versions through 0.28 for Perl generate insecure random values for salts.<br /> <br /> These versions use the built-in rand function, which is predictable and unsuitable for cryptography.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-12898
Publication date:
20/07/2026
The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-12970
Publication date:
20/07/2026
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-12972
Publication date:
20/07/2026
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to tamper with the payment-related metadata of arbitrary WooCommerce orders.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-12973
Publication date:
20/07/2026
The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-13142
Publication date:
20/07/2026
The Social Login, Passkeys, Magic Link &amp; Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a registered email address to brute-force the code and log in as that user, including an administrator, leading to full site takeover.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-13147
Publication date:
20/07/2026
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-13156
Publication date:
20/07/2026
The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but ignores the nonce), so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin before 1.0.8&amp;#39;s SMTP configuration and deactivates the MailerSend WordPress plugin before 1.0.8, breaking the site&amp;#39;s email delivery.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026

CVE-2026-13432
Publication date:
20/07/2026
The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access or higher to deactivate the ThumbPress WordPress plugin before 6.2.2, disrupting the site&amp;#39;s image-handling functionality.
Severity CVSS v4.0: Pending analysis
Last modification:
20/07/2026
Subscribe to Vulnerabilities