https://vulnerability.circl.lu/cna-root/INCIBE/recent Most recent vulnerabilities from the INCIBE CNA root 2026-08-25T15:39:02.307389+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Latest vulnerabilities published by the CNAs operating under the INCIBE root of the CVE Program. https://vulnerability.circl.lu/vuln/cve-2026-12600 CVE-2026-12600 (INCIBE) 2026-08-25T10:57:57.486000+00:00 Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoderUncontrolled memory usage in Innodata Labs’ Poppler JPX decoder Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoderUncontrolled memory usage in Innodata Labs’ Poppler JPX decoder 2026-08-25T10:57:57.486000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-78365 CVE-2026-78365 (Secur0) 2026-08-24T12:49:36.802000+00:00 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification 2026-08-24T12:49:36.802000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-78337 CVE-2026-78337 (Secur0) 2026-08-24T11:01:30.518000+00:00 Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG 2026-08-24T11:01:30.518000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-77780 CVE-2026-77780 (Secur0) 2026-08-21T12:12:59.160000+00:00 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers 2026-08-21T12:12:59.160000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-77759 CVE-2026-77759 (Secur0) 2026-08-21T11:29:43.550000+00:00 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records 2026-08-21T11:29:43.550000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-76203 CVE-2026-76203 (Secur0) 2026-08-19T14:23:17.894000+00:00 CSS sanitizer bypass in Pentestify report themes allows forced outbound requests CSS sanitizer bypass in Pentestify report themes allows forced outbound requests 2026-08-19T14:23:17.894000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-75872 CVE-2026-75872 (Secur0) 2026-08-18T14:06:37.102000+00:00 HTML Injection in MailerUp double opt-in verification email HTML Injection in MailerUp double opt-in verification email 2026-08-18T14:06:37.102000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-19871 CVE-2026-19871 (Secur0) 2026-08-14T14:00:55.572000+00:00 Use of hard-coded credentials in Prospero Flow CRM employee onboarding Use of hard-coded credentials in Prospero Flow CRM employee onboarding 2026-08-14T14:00:55.572000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-19870 CVE-2026-19870 (Secur0) 2026-08-14T12:08:30.457000+00:00 IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation 2026-08-14T12:08:30.457000+00:00 https://vulnerability.circl.lu/vuln/cve-2026-19744 CVE-2026-19744 (Secur0) 2026-08-13T15:41:00.862000+00:00 Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes Stored Cross-site Scripting in Pentestify Markdown renderer via unescaped quotes 2026-08-13T15:41:00.862000+00:00