Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-77140

Publication date:

25/08/2026

The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-77141

Publication date:

25/08/2026

The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-77128

Publication date:

25/08/2026

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-77129

Publication date:

25/08/2026

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-77130

Publication date:

25/08/2026

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project&#39;s API key.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-77131

Publication date:

25/08/2026

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project&#39;s API key.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-77133

Publication date:

25/08/2026

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-77134

Publication date:

25/08/2026

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-63587

Publication date:

25/08/2026

The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the &#39;Enable Password Authorization&#39; setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability.

Severity CVSS v4.0: HIGH

Last modification:

25/08/2026

CVE-2026-77127

Publication date:

25/08/2026

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the requested field, leading to disclosure of sensitive information such as backend and frontend user password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extensions backend module.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-63586

Publication date:

25/08/2026

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system() function. By submitting a specially crafted username containing shell metacharacters, an unauthenticated attacker with network access to the device can escape the command context and execute arbitrary commands with root privileges.

Severity CVSS v4.0: CRITICAL

Last modification:

25/08/2026

CVE-2026-56093

Publication date:

25/08/2026

The extension&#39;s frontend detail-view document lookup does not apply the current site&#39;s siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsewhere.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

Subscribe to Vulnerabilities