Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-77128

Publication date:

25/08/2026

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-77129

Publication date:

25/08/2026

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-77130

Publication date:

25/08/2026

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project&#39;s API key.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-77131

Publication date:

25/08/2026

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project&#39;s API key.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-77133

Publication date:

25/08/2026

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-77134

Publication date:

25/08/2026

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

CVE-2026-63587

Publication date:

25/08/2026

The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the &#39;Enable Password Authorization&#39; setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliberately trigger this by submitting 5 or more invalid passwords, after which subsequent SMS commands are executed without requiring a password, resulting in potential limited configuration tampering, limited information leakage and potentially full loss of availability.

Severity CVSS v4.0: HIGH

Last modification:

25/08/2026

CVE-2026-77127

Publication date:

25/08/2026

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the requested field, leading to disclosure of sensitive information such as backend and frontend user password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extensions backend module.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-63586

Publication date:

25/08/2026

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system() function. By submitting a specially crafted username containing shell metacharacters, an unauthenticated attacker with network access to the device can escape the command context and execute arbitrary commands with root privileges.

Severity CVSS v4.0: CRITICAL

Last modification:

25/08/2026

CVE-2026-56093

Publication date:

25/08/2026

The extension&#39;s frontend detail-view document lookup does not apply the current site&#39;s siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsewhere.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-56094

Publication date:

25/08/2026

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system&#39;s own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

CVE-2026-56095

Publication date:

25/08/2026

The extension&#39;s indexer passed every field value returned by content object rendering through PHP&#39;s unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.

Severity CVSS v4.0: HIGH

Last modification:

26/08/2026

Subscribe to Vulnerabilities