Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-50212

Publication date:
04/06/2026
Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user endpoints, causing severe denial of service.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2026-50213

Publication date:
04/06/2026
The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2026-3820

Publication date:
04/06/2026
There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. <br /> An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.<br /> <br /> Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.
Severity CVSS v4.0: Pending analysis
Last modification:
22/07/2026

CVE-2026-50205

Publication date:
04/06/2026
System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2026-50206

Publication date:
04/06/2026
Incoming VPN network profile settings fail to process special characters safely, enabling command injection via malicious config files.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2026-49191

Publication date:
04/06/2026
The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.
Severity CVSS v4.0: CRITICAL
Last modification:
22/07/2026

CVE-2026-49192

Publication date:
04/06/2026
The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.
Severity CVSS v4.0: MEDIUM
Last modification:
22/07/2026

CVE-2026-49193

Publication date:
04/06/2026
Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2026-49194

Publication date:
04/06/2026
The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.
Severity CVSS v4.0: CRITICAL
Last modification:
22/07/2026

CVE-2026-49202

Publication date:
04/06/2026
Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2026-49203

Publication date:
04/06/2026
Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.
Severity CVSS v4.0: HIGH
Last modification:
22/07/2026

CVE-2026-49204

Publication date:
04/06/2026
Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.
Severity CVSS v4.0: MEDIUM
Last modification:
22/07/2026