cve-coordination@incibe.es
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS cve-coordination@incibe.es
03
assessed vulnerabilities (1,186)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-4337US | — | — | ||
Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user to upload any type of file to the server, and to any path whe… | ||||
| CVE-2026-117494US | — | — | ||
Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are pro… | ||||
| CVE-2026-117493US | — | — | ||
Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code enter… | ||||
| CVE-2026-4316US | — | — | ||
Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP respon… | ||||
| CVE-2026-103377US | — | — | ||
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds… | ||||
| CVE-2026-11960US | — | — | ||
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an… | ||||
| CVE-2026-11959US | — | — | ||
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in t… | ||||
| CVE-2026-13695US | — | — | ||
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_L… | ||||
| CVE-2026-112161US | —OT elevated | — | ||
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can re… | ||||
| CVE-2026-111472US | — | — | ||
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sendi… | ||||
| CVE-2026-101300US | — | — | ||
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can… | ||||
| CVE-2026-101287US | — | — | ||
Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its integrity. The application stores the… | ||||
| CVE-2026-108072US | —OT elevated | — | ||
Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without suff… | ||||
| CVE-2026-108071US | — | — | ||
Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials… | ||||
| CVE-2026-108070US | — | — | ||
A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by ma… | ||||
| CVE-2026-14851US | — | — | ||
A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financia… | ||||
| CVE-2026-96535US | — | — | ||
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisati… | ||||
| CVE-2026-4264US | — | — | ||
Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user… | ||||
| CVE-2026-4894US | — | — | ||
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by ma… | ||||
| CVE-2026-12260US | — | — | ||
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter… | ||||