Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-77066

Publication date:

20/08/2026

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.

Severity CVSS v4.0: MEDIUM

Last modification:

20/08/2026

CVE-2026-77067

Publication date:

20/08/2026

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.

Severity CVSS v4.0: MEDIUM

Last modification:

20/08/2026

CVE-2026-77026

Publication date:

20/08/2026

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension

Severity CVSS v4.0: MEDIUM

Last modification:

20/08/2026

CVE-2026-76610

Publication date:

20/08/2026

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo

Severity CVSS v4.0: MEDIUM

Last modification:

20/08/2026

CVE-2026-14948

Publication date:

20/08/2026

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives.

Severity CVSS v4.0: HIGH

Last modification:

20/08/2026

CVE-2026-14949

Publication date:

20/08/2026

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.

Severity CVSS v4.0: HIGH

Last modification:

20/08/2026

CVE-2026-14950

Publication date:

20/08/2026

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.

Severity CVSS v4.0: CRITICAL

Last modification:

20/08/2026

CVE-2026-14951

Publication date:

20/08/2026

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.

Severity CVSS v4.0: HIGH

Last modification:

20/08/2026

CVE-2026-14952

Publication date:

20/08/2026

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users.

Severity CVSS v4.0: HIGH

Last modification:

20/08/2026

CVE-2026-14953

Publication date:

20/08/2026

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.

Severity CVSS v4.0: MEDIUM

Last modification:

20/08/2026

CVE-2026-14947

Publication date:

20/08/2026

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of archive entry paths before writing files to disk which could result in full system compromise.

Severity CVSS v4.0: HIGH

Last modification:

20/08/2026

CVE-2026-14946

Publication date:

20/08/2026

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise.

Severity CVSS v4.0: HIGH

Last modification:

20/08/2026

Subscribe to Vulnerabilities