Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-50739
Publication date:
26/06/2026
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-50745
Publication date:
26/06/2026
A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-50744
Publication date:
26/06/2026
A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked session ID could be used to perform subsequent API calls without restrictions.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-50742
Publication date:
26/06/2026
A stored XSS vulnerabilities exists in the `maintenance-acl-check.php` and `maintenance-banners-check.php` tools of Revive Adserver 6.0.7. The issue was caused by entity names being displayed without proper escaping when inconsistencies were detected. Whether the XSS payload is executed when an administrator uses the affected maintenance tools is not entirely under the attacker's control.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-50741
Publication date:
26/06/2026
Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RPC API method.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-48935
Publication date:
26/06/2026
A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was set as read-only with e.g. `--allow-fs-read`.<br /> <br /> This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2026

CVE-2026-48936
Publication date:
26/06/2026
A flaw in Node.js Permission API can cause a local server to be started (via a Unix domain socket), even without the `--allow-net` permission.<br /> <br /> This vulnerability affects one supported release line: **Node.js 26**.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2026

CVE-2026-48934
Publication date:
26/06/2026
A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation.<br /> <br /> This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-48615
Publication date:
26/06/2026
A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.<br /> <br /> When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.<br /> <br /> This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2026

CVE-2026-48619
Publication date:
26/06/2026
A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out of Memory error on the client.<br /> <br /> This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2026

CVE-2026-48928
Publication date:
26/06/2026
A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups.<br /> <br /> This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2026

CVE-2026-48930
Publication date:
26/06/2026
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in resolver bindings.<br /> <br /> This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2026
Subscribe to Vulnerabilities