Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-50630

Publication date:

12/06/2026

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the &#39;realm&#39; parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50629

Publication date:

12/06/2026

The &#39;clientId&#39; parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server&#39;s log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50623

Publication date:

12/06/2026

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing &#39;throw&#39; keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

16/06/2026

CVE-2026-48914

Publication date:

12/06/2026

A flaw was found in QEMU&#39;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-50627

Publication date:

12/06/2026

The JwtAccessTokenValidator class in Apache CXF fails to validate the &#39;aud&#39; (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-50628

Publication date:

12/06/2026

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-49875

Publication date:

12/06/2026

Apache CXF&#39;s EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

28/07/2026

CVE-2026-11844

Publication date:

12/06/2026

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Read vulnerability, allowing privileged remote attackers to access files outside the intended directory scope.

Severity CVSS v4.0: MEDIUM

Last modification:

12/06/2026

CVE-2026-11845

Publication date:

12/06/2026

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged remote attackers to inject arbitrary OS commands and execute them on the device.

Severity CVSS v4.0: HIGH

Last modification:

12/06/2026

CVE-2026-11846

Publication date:

12/06/2026

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories, resulting in data destruction or service disruption.

Severity CVSS v4.0: HIGH

Last modification:

12/06/2026

CVE-2026-11847

Publication date:

12/06/2026

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Path Traversal vulnerability, allowing authenticated remote attackers to exploit this vulnerability to create directories in unintended system paths.

Severity CVSS v4.0: MEDIUM

Last modification:

12/06/2026