Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-44616
Publication date:
30/07/2026
LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through the user-search endpoint                   and potentially expose directory information. The role-lookup path was also affected after successful LDAP authentication. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which                   fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2026

CVE-2026-44613
Publication date:
30/07/2026
Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a                   malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
07/08/2026

CVE-2026-4978
Publication date:
30/07/2026
Improper neutralization of special elements used in an SQL command (&amp;#39;SQL injection&amp;#39;) vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection.<br /> <br /> This issue affects Traffic Analysis System: from 30 before 34.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-28814
Publication date:
30/07/2026
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.<br /> Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2026

CVE-2026-28813
Publication date:
30/07/2026
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.<br /> Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2026

CVE-2026-23985
Publication date:
30/07/2026
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration.<br /> The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequence of backslashes or similar characters) to endpoints that process SQL queries<br /> <br /> This issue affects Apache Superset: before 6.0.0.<br /> <br /> Users are recommended to upgrade to version 6.0.0, which fixes the issue. <br /> <br /> Workarounds:<br /> ● WAF Rules: Implement Web Application Firewall (WAF) rules to detect and block<br /> requests containing excessively long sequences of backslashes or suspicious repeated<br /> patterns in the queries.extras.where parameter.<br /> ● Rate Limiting: Ensure strict rate limiting is applied to the /api/v1/chart/data endpoint to<br /> reduce the impact of potential attacks.
Severity CVSS v4.0: MEDIUM
Last modification:
05/08/2026

CVE-2026-23981
Publication date:
30/07/2026
An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart&amp;#39;s properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartCommand failed to verify that the user had write permissions for the target dashboards specified in the request body. <br /> <br /> This issue affects Apache Superset: before 6.0.0.<br /> <br /> Users are recommended to upgrade to version 6.0.0, which fixes the issue.
Severity CVSS v4.0: MEDIUM
Last modification:
05/08/2026

CVE-2026-28812
Publication date:
30/07/2026
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.<br /> Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2026

CVE-2026-28811
Publication date:
30/07/2026
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3.<br /> Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2026

CVE-2026-28323
Publication date:
30/07/2026
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2026

CVE-2026-15657
Publication date:
30/07/2026
A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2026

CVE-2026-15658
Publication date:
30/07/2026
A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that<br /> returns the records of other users without checking that the caller owns the data associated with that record.
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2026
Subscribe to Vulnerabilities