Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-82331
Publication date:
23/09/2026
Improper link resolution before file access (&amp;#39;link following&amp;#39;) vulnerability in the `tar` source plugin of Apache BuildStream running on Python = 3.12, BuildStream &gt;= 2.3.0 already makes use of the Python `tarfile` filter functionality, which blocks the symlink escape<br /> <br /> Users are recommended to upgrade to version 2.8.1, which fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-5924
Publication date:
23/09/2026
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block&amp;#39;s &amp;#39;customStyle&amp;#39; attribute in all versions up to, and including, 2.1.3. This is due to the use of eval() on user-controlled block content in the frontend JavaScript mapStyles() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-6831
Publication date:
23/09/2026
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the &amp;#39;acf7db&amp;#39; shortcode.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93510
Publication date:
23/09/2026
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93511
Publication date:
23/09/2026
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal&amp;#39;s webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-93528
Publication date:
23/09/2026
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order&amp;#39;s details, allowing unauthenticated attackers to view another customer&amp;#39;s order using the order&amp;#39;s key.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-89331
Publication date:
23/09/2026
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board&amp;#39;s members, typically including administrators.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-90951
Publication date:
23/09/2026
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member&amp;#39;s in-flight payment identifier to delete that member&amp;#39;s checkout state.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-90985
Publication date:
23/09/2026
The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress&amp;#39;s post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-91024
Publication date:
23/09/2026
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-91025
Publication date:
23/09/2026
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user&amp;#39;s Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user&amp;#39;s own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21&amp;#39;s per-user settings on arbitrary users, including administrators.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-91073
Publication date:
23/09/2026
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026
Subscribe to Vulnerabilities