Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-37003

Publication date:

27/08/2026

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-37004

Publication date:

27/08/2026

BerriAI litellm

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-37006

Publication date:

27/08/2026

A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-37007

Publication date:

27/08/2026

A vulnerability in FileWriterTool in crewai-tools

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-37009

Publication date:

27/08/2026

A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query argument.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-37012

Publication date:

27/08/2026

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-37064

Publication date:

27/08/2026

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen &#39;user_name&#39; parameter to test if the user exists.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-35868

Publication date:

27/08/2026

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC2100_AZ3 V1.0.4. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An attacker can exploit this vulnerability by injecting specially crafted shell metacharacters or payloads into the vulnerable parameter, resulting in the execution of arbitrary operating system commands.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-35869

Publication date:

27/08/2026

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of LB-link Router AC450M V4.0.0. This flaw occurs due to insufficient validation and sanitization of user-supplied input before it is passed to a system-level command execution context. An attacker can exploit this vulnerability by injecting specially crafted shell metacharacters or payloads into the vulnerable parameter, resulting in the execution of arbitrary operating system commands.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-36102

Publication date:

27/08/2026

An issue in the inviteController.js component in Bluewave Labs Checkmate

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-34620

Publication date:

27/08/2026

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-34616

Publication date:

27/08/2026

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

Subscribe to Vulnerabilities