INCIBE

Reports to INCIBE (13)

Latest CVEs (this partner and the CNAs under it) · RSS

• CVE-2026-101300 2026-10-16 · CVSS 7.1
  Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a p
• CVE-2026-111472 2026-10-16 · CVSS 9.3
  An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from t
• CVE-2026-104024 2026-10-15 · Secur0 · CVSS 4.6
  Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0
• CVE-2026-104025 2026-10-15 · Secur0 · CVSS 8.4
  Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who conv
• CVE-2026-101287 2026-10-15 · CVSS 9.3
  Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The app
• CVE-2026-100169 2026-10-14 · Secur0 · CVSS 7.6
  Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to ob
• CVE-2026-108072 2026-10-14 · CVSS 5.4
  Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allo
• CVE-2026-108071 2026-10-14 · CVSS 8.7
  Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first
• CVE-2026-108070 2026-10-14 · CVSS 8.7
  A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resou
• CVE-2026-14851 2026-10-14 · CVSS 9.2
  A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable informatio
• CVE-2026-96535 2026-10-13 · CVSS 5.1
  Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to
• CVE-2026-4264 2026-10-09 · CVSS 5.1
  Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper
• CVE-2026-4894 2026-10-08 · CVSS 6.9
  A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses
• CVE-2026-12260 2026-10-08 · CVSS 10.0
  SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ end
• CVE-2026-92533 2026-10-07 · CVSS 7.1
  Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied
• CVE-2026-92532 2026-10-07 · CVSS 7.5
  Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the appl
• CVE-2026-92531 2026-10-07 · CVSS 7.5
  Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresp
• CVE-2026-5703 2026-10-07 · CVSS 7.1
  Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticat
• CVE-2026-103831 2026-10-06 · CVSS 7.5
  CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native uns
• CVE-2026-4889 2026-10-06 · CVSS 7.8
  SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=ver
• CVE-2026-59668 2026-10-02 · CVSS 4.8
  Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execut
• CVE-2026-59667 2026-10-02 · CVSS 4.8
  Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execut
• CVE-2026-59666 2026-10-02 · CVSS 4.8
  Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execut
• CVE-2026-59665 2026-10-02 · CVSS 4.8
  Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execut
• CVE-2026-59662 2026-10-02 · CVSS 4.8
  Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into execut