Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-30046
Publication date:
27/08/2026
A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-30047
Publication date:
27/08/2026
A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-30050
Publication date:
27/08/2026
An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-30056
Publication date:
27/08/2026
A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-30057
Publication date:
27/08/2026
An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-26453
Publication date:
27/08/2026
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_server_handle_session() function when processing COAP messages containing URI_PATH options with NULL data pointers. When the server searches for a URI_PATH option matching the string "separate", it directly calls strncmp() on option_list[i].data without checking if the pointer is NULL. This causes a segmentation fault when the option's data field is NULL.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-26456
Publication date:
27/08/2026
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes without proper synchronization.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-26457
Publication date:
27/08/2026
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a null pointer dereference vulnerability in the coap_dump_msg() function when processing COAP messages containing options with zero length.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-26459
Publication date:
27/08/2026
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vulnerability in the option parsing logic that causes a segmentation fault when processing malformed COAP messages with insufficient option data.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-26897
Publication date:
27/08/2026
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-26899
Publication date:
27/08/2026
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR #15 (
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026

CVE-2026-26452
Publication date:
27/08/2026
ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a vulnerability in the option parsing logic that causes a segmentation fault when processing COAP messages containing invalid option numbers.
Severity CVSS v4.0: Pending analysis
Last modification:
27/08/2026
Subscribe to Vulnerabilities