Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-71413

Publication date:

07/08/2026

Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency.

Severity CVSS v4.0: MEDIUM

Last modification:

10/08/2026

CVE-2025-63235

Publication date:

07/08/2026

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2026

CVE-2025-71409

Publication date:

07/08/2026

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.

Severity CVSS v4.0: HIGH

Last modification:

10/08/2026

CVE-2025-71410

Publication date:

07/08/2026

Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio frequency.

Severity CVSS v4.0: MEDIUM

Last modification:

10/08/2026

CVE-2026-64636

Publication date:

07/08/2026

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2026

CVE-2026-64637

Publication date:

07/08/2026

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2026

CVE-2026-64638

Publication date:

07/08/2026

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).

Severity CVSS v4.0: HIGH

Last modification:

07/08/2026

CVE-2026-66058

Publication date:

07/08/2026

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

Severity CVSS v4.0: MEDIUM

Last modification:

10/08/2026

CVE-2026-56818

Publication date:

07/08/2026

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2026

CVE-2026-47364

Publication date:

07/08/2026

In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user&#39;s Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog&#39;s own systems.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2026

CVE-2026-47363

Publication date:

07/08/2026

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim&#39;s app. Impact: A co-installed application can switch the victim&#39;s Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim&#39;s existing session or data.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2026

CVE-2026-47361

Publication date:

07/08/2026

In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversation_id. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ID 9201 (the Bits AI chat notification), with no check on the caller&#39;s identity or ownership of the conversation. This requires a malicious application co-installed on the victim&#39;s device. Impact: A co-installed application can silently dismiss the victim&#39;s Bits AI chat notification. No chat content is exposed; conversation data remains server-authentication gated and is never returned to the caller.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2026

Subscribe to Vulnerabilities