Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-102396
Publication date:
30/09/2026
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-102398
Publication date:
30/09/2026
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-102399
Publication date:
30/09/2026
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-103115
Publication date:
30/09/2026
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
02/10/2026

CVE-2026-102384
Publication date:
30/09/2026
Author Cross Site Scripting (XSS) in Supreme Modules Lite
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-100508
Publication date:
30/09/2026
Unauthenticated Denial of Service Attack in Two Factor
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-100513
Publication date:
30/09/2026
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-100507
Publication date:
30/09/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1.
Severity CVSS v4.0: Pending analysis
Last modification:
07/10/2026

CVE-2026-88920
Publication date:
30/09/2026
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key.<br /> <br /> Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
02/10/2026

CVE-2026-87830
Publication date:
30/09/2026
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption.<br /> Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
06/10/2026

CVE-2026-85532
Publication date:
30/09/2026
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes.<br /> Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
02/10/2026

CVE-2026-62146
Publication date:
30/09/2026
A trust-boundary flaw in CRI-O&amp;#39;s sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O&amp;#39;s own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-side runtime-management resource inside the container, enabling container escape.
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026
Subscribe to Vulnerabilities