Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-96872

Publication date:

23/09/2026

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs.<br /> <br /> This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

Severity CVSS v4.0: LOW

Last modification:

24/09/2026

CVE-2026-96770

Publication date:

23/09/2026

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go&#39;s RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate&#39;s private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy&#39;s configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.

Severity CVSS v4.0: CRITICAL

Last modification:

24/09/2026

CVE-2026-96541

Publication date:

23/09/2026

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-96545

Publication date:

23/09/2026

An out-of-bounds heap read flaw was found in GIMP&#39;s TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-96546

Publication date:

23/09/2026

A one-byte out-of-bounds heap read flaw was found in GIMP&#39;s uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2026

CVE-2026-96549

Publication date:

23/09/2026

A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Severity CVSS v4.0: LOW

Last modification:

23/09/2026

CVE-2026-96548

Publication date:

23/09/2026

A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack&#39;s complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Severity CVSS v4.0: LOW

Last modification:

23/09/2026

CVE-2026-95600

Publication date:

23/09/2026

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2026

CVE-2026-95603

Publication date:

23/09/2026

Shop manager PHP Object Injection in Reycob Product Import Export

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2026

CVE-2026-95601

Publication date:

23/09/2026

Unauthenticated SQL Injection in Product Filter by WBW

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2026

CVE-2026-95602

Publication date:

23/09/2026

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.<br /> <br /> This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2026