Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-93772

Publication date:
23/09/2026
Subscriber Cross Site Scripting (XSS) in wpForo Forum
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93774

Publication date:
23/09/2026
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93622

Publication date:
23/09/2026
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93623

Publication date:
23/09/2026
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93773

Publication date:
23/09/2026
Contributor SQL Injection in Mollie Forms
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93513

Publication date:
23/09/2026
Contributor Insecure Direct Object References (IDOR) in SiteSkite
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93526

Publication date:
23/09/2026
Unauthenticated Cross Site Scripting (XSS) in Event Tickets
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93529

Publication date:
23/09/2026
Contributor Broken Access Control in WSP MCP – AI Agents Connector
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93527

Publication date:
23/09/2026
Contributor SQL Injection in Live Copy Paste for Elementor
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93618

Publication date:
23/09/2026
Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS.<br /> <br /> This issue affects JetTricks: from n/a through 2.0.1.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93421

Publication date:
23/09/2026
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.
Severity CVSS v4.0: MEDIUM
Last modification:
30/09/2026

CVE-2026-92692

Publication date:
23/09/2026
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.
Severity CVSS v4.0: MEDIUM
Last modification:
23/09/2026