Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-8335

Publication date:

10/06/2026

A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints.<br /> All releases up to 1.2.4 are considered vulnerable. Status of next releases is unknown as the vulnerability has not been addressed by any patch.

Severity CVSS v4.0: HIGH

Last modification:

10/06/2026

CVE-2026-53475

Publication date:

10/06/2026

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Middle (MITM) attacker to intercept and harvest vCenter administrator credentials. This can lead to unauthorized access to vCenter.

Severity CVSS v4.0: Pending analysis

Last modification:

16/06/2026

CVE-2026-53476

Publication date:

10/06/2026

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

Severity CVSS v4.0: Pending analysis

Last modification:

16/06/2026

CVE-2026-53689

Publication date:

10/06/2026

libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.

Severity CVSS v4.0: Pending analysis

Last modification:

19/07/2026

CVE-2026-53469

Publication date:

10/06/2026

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform.

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2026

CVE-2026-53470

Publication date:

10/06/2026

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim&#39;s source.

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2026

CVE-2026-53471

Publication date:

10/06/2026

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2026

CVE-2026-53473

Publication date:

10/06/2026

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user&#39;s browser session. This cross-site scripting (XSS) vulnerability allows the attacker to compromise the victim&#39;s Red Hat Single Sign-On (SSO) session, potentially leading to unauthorized cross-tenant data access and API actions.

Severity CVSS v4.0: Pending analysis

Last modification:

16/06/2026

CVE-2026-53474

Publication date:

10/06/2026

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL Injection allows for arbitrary file reading on the system, potentially exposing sensitive information such as Kubernetes service account tokens and other credentials, which could lead to a full compromise of the SaaS environment.

Severity CVSS v4.0: Pending analysis

Last modification:

16/06/2026

CVE-2026-45561

Publication date:

10/06/2026

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,checks}/ family of routes takes the URL path component verbatim into requests.get(f&#39;http://{server_ip}:{agent_port}/...&#39;). The path component is constrained only by Flask&#39;s default URL converter, which permits any value (including IPv4 literals like 169.254.169.254, RFC1918 ranges, and 127.0.0.1). At time of publication, there are no publicly available patches.

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2026

CVE-2026-45563

Publication date:

10/06/2026

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history// re-uses the server_ip path parameter as a user-id when service == &#39;user&#39;, with no authorization check. Any authenticated user — even a guest in an unrelated group — can list any other user&#39;s full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2026

CVE-2026-45564

Publication date:

10/06/2026

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions////save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.system(f"dos2unix -q {cfg}"). configver is not run through EscapedString (Pydantic doesn&#39;t validate path segments declared as str) and the surrounding .. block is the broken tuple-membership patch from GHSA-vapt-004. An authenticated user with role

Severity CVSS v4.0: Pending analysis

Last modification:

10/06/2026

Subscribe to Vulnerabilities