Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-47065
Publication date:
03/06/2026
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy<br /> <br /> <br /> Assessment: Fully addressed.<br /> <br /> <br /> When the serialised stream contains a TC_PROXYCLASSDESC (the marker <br /> for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc()<br /> is<br /> dispatched. JDK then calls the default <br /> ObjectInputStream.resolveProxyClass(interfaces) implementation, which <br /> performs Class.forName(intf, false, latestUserDefinedLoader()) for EACH <br /> interface name and constructs the proxy class — bypassing the accepted<br /> classes list .<br /> <br /> <br /> ZDRES-233: Class.forName(name, initialize=true, classLoader) in <br /> readClassDescriptor Triggers Static Initialiser of Allow-Listed Classes<br /> <br /> <br /> Assessment: Fully addressed.<br /> <br /> <br /> For ANY class on the allow-list, deserialising a stream that names it triggers the class’s <br /> (static initialiser) BEFORE any instance is constructed. This means an <br /> attacker who supplies a class name on the allow-list (e.g., the <br /> developer wrote accept(“com.myapp.*") , attacker supplies <br /> com.myapp.SomeClass ) causes of SomeClass — and many <br /> real-world classes have side-effecting static initialisers<br /> <br /> <br /> Both issues have been fixed.
Severity CVSS v4.0: Pending analysis
Last modification:
22/07/2026

CVE-2025-14772
Publication date:
03/06/2026
Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus.<br /> <br /> This issue affects T-MAC Plus: 4.0-24.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2025-14773
Publication date:
03/06/2026
Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in ABB T-MAC Plus.<br /> <br /> This issue affects T-MAC Plus: 4.0-24.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2025-14771
Publication date:
03/06/2026
Files or directories accessible to external parties vulnerability in ABB T-MAC Plus.<br /> <br /> This issue affects T-MAC Plus: 4.0-24.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2026-4035
Publication date:
03/06/2026
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server&amp;#39;s environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.
Severity CVSS v4.0: Pending analysis
Last modification:
21/07/2026

CVE-2025-15654
Publication date:
03/06/2026
Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) vulnerability in Fox-themes Prague allows Reflected XSS.<br /> <br /> This issue affects Prague: from n/a through 2.2.8.
Severity CVSS v4.0: Pending analysis
Last modification:
22/07/2026

CVE-2026-5078
Publication date:
03/06/2026
Impact: The morgan logging middleware&amp;#39;s :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.
Severity CVSS v4.0: Pending analysis
Last modification:
22/07/2026

CVE-2026-50052
Publication date:
03/06/2026
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync<br /> attack (request smuggling), which in turn can be used for cache poisoning,<br /> authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the<br /> feature parameter to contain +http2. HTTP/2 support is disabled by<br /> default.
Severity CVSS v4.0: LOW
Last modification:
22/07/2026

CVE-2026-50031
Publication date:
03/06/2026
ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands "ipmi-oem dell get-active-directory-config" and "ipmi-oem fujitsu get-sel-entry-long-text" were found to have exploitable buffer overflows on response messages.
Severity CVSS v4.0: Pending analysis
Last modification:
22/07/2026

CVE-2026-10704
Publication date:
03/06/2026
A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
22/07/2026

CVE-2026-10705
Publication date:
03/06/2026
A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.
Severity CVSS v4.0: LOW
Last modification:
22/07/2026

CVE-2026-10703
Publication date:
03/06/2026
A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRouterRequestStructure of the file cipmessagerouter.c of the component SendRRData Handler. The manipulation leads to use after free. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
22/07/2026
Subscribe to Vulnerabilities