Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-49190

Publication date:

04/06/2026

The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.

Severity CVSS v4.0: CRITICAL

Last modification:

22/07/2026

CVE-2026-50219

Publication date:

04/06/2026

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-49187

Publication date:

04/06/2026

The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.

Severity CVSS v4.0: HIGH

Last modification:

22/07/2026

CVE-2026-49188

Publication date:

04/06/2026

The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.

Severity CVSS v4.0: HIGH

Last modification:

22/07/2026

CVE-2026-49189

Publication date:

04/06/2026

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.

Severity CVSS v4.0: HIGH

Last modification:

22/07/2026

CVE-2026-10805

Publication date:

04/06/2026

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager&#39;s dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-48681

Publication date:

04/06/2026

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-49185

Publication date:

04/06/2026

The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.

Severity CVSS v4.0: CRITICAL

Last modification:

22/07/2026

CVE-2026-49186

Publication date:

04/06/2026

The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.

Severity CVSS v4.0: HIGH

Last modification:

22/07/2026

CVE-2026-44917

Publication date:

04/06/2026

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxe_template.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-41283

Publication date:

04/06/2026

OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-41010

Publication date:

04/06/2026

ReleaseJob#unpack builds job_dir = File.join(@release_dir, &#39;jobs&#39;, name) and job_tgz = File.join(@release_dir, &#39;jobs&#39;, "#{name}.tgz") where name returns @job_meta[&#39;name&#39;], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :on_error => :return). Bosh::Common::Exec.sh executes via %x{#{command}} (bosh-common/lib/bosh/common/exec.rb:53), i.e. /bin/sh -c, so any shell metacharacters in name are interpreted. FileUtils.mkdir_p(job_dir) on line 49 creates the literal directory (no shell) and succeeds even when the name contains $()/;, so execution reaches the sh call.<br /> <br /> Affected versions:<br /> - BOSH Director: all versions prior to v282.1.12 (inclusive); fixed in v282.1.12 or later

Severity CVSS v4.0: HIGH

Last modification:

22/07/2026

Subscribe to Vulnerabilities