Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-65931
Publication date:
27/08/2026
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint.<br /> <br /> <br /> <br /> An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey menu entries without the expected settings:update privilege. The endpoint also allows the attacker to submit menu IDs that the normal interface and intended update workflow restrict for non-superadministrators, enabling unauthorized changes to administrative navigation records.<br /> <br /> <br /> <br /> This issue affects LimeSurvey: 7.0.5.
Severity CVSS v4.0: MEDIUM
Last modification:
28/08/2026

CVE-2026-66353
Publication date:
27/08/2026
Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) vulnerability in woylie doggo allows Reflected XSS.<br /> <br /> Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning "already escaped, emit verbatim", without escaping them, so the value reached the value attribute of the rendered by the field component unchanged. Any application rendering over user-controlled params is affected through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value. The pattern kept exactly the first ten bytes and discarded shorter values, capping a payload at ten bytes: enough to terminate the attribute and open an element or attach a short event handler, not enough to place attacker-chosen script inline. Only type="date" is affected.<br /> <br /> This issue affects doggo: from 0.1.0 before 0.14.8.
Severity CVSS v4.0: MEDIUM
Last modification:
28/08/2026

CVE-2026-59320
Publication date:
27/08/2026
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver&amp;#39;s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.<br /> Spring AMQP 4.1.0
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59321
Publication date:
27/08/2026
A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message&amp;#39;s payload/headers bindings into another message&amp;#39;s script evaluation or throwing spurious exceptions.<br /> Spring Integration 7.1.0<br /> Spring Integration 7.0.0 - 7.0.5<br /> Spring Integration 6.5.0 - 6.5.10<br /> Spring Integration 6.4.0 - 6.4.12<br /> Spring Integration 5.5.21 and earlier
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59322
Publication date:
27/08/2026
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default.<br /> Spring Integration 7.1.0<br /> Spring Integration 7.0.0 - 7.0.5<br /> Spring Integration 6.5.0 - 6.5.10<br /> Spring Integration 6.4.0 - 6.4.12<br /> Spring Integration 5.5.21 and earlier
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59324
Publication date:
27/08/2026
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream.<br /> Spring Integration 7.1.0<br /> Spring Integration 7.0.0 - 7.0.5<br /> Spring Integration 6.5.0 - 6.5.10<br /> Spring Integration 6.4.0 - 6.4.12<br /> Spring Integration 5.5.21 and earlier
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59313
Publication date:
27/08/2026
Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).<br /> Spring Framework 7.0.0 - 7.0.8<br /> Spring Framework 6.2.0 - 6.2.19<br /> Spring Framework 6.1.0 - 6.1.28<br /> Spring Framework 6.0.0 - 6.0.30<br /> Spring Framework 5.3.0 - 5.3.49
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59311
Publication date:
27/08/2026
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts.<br /> Spring Integration 7.1.0<br /> Spring Integration 7.0.0 - 7.0.5<br /> Spring Integration 6.5.0 - 6.5.10<br /> Spring Integration 6.4.0 - 6.4.12
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59315
Publication date:
27/08/2026
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads.<br /> Spring Cloud Config 5.0.0 - 5.0.4<br /> Spring Cloud Config 4.3.0 - 4.3.4<br /> Spring Cloud Config 4.0.0 - 4.2.8<br /> Spring Cloud Config 3.1.14 and earlier
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59316
Publication date:
27/08/2026
Spring Authorization Server&amp;#39;s default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user.<br /> Spring Authorization Server 1.5.0 - 1.5.8<br /> Spring Authorization Server 1.4.0 - 1.4.11
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59317
Publication date:
27/08/2026
DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new BigInteger(header.value()) with no length or format validation.<br /> Spring for Apache Kafka 4.1.0<br /> Spring for Apache Kafka 4.0.0 - 4.0.6<br /> Spring for Apache Kafka 3.0.0 - 3.3.16<br /> Spring for Apache Kafka 2.9.0 - 2.9.14<br /> Spring for Apache Kafka 2.8.12 and earlier
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026

CVE-2026-59319
Publication date:
27/08/2026
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index.<br /> Spring AI 2.0.0
Severity CVSS v4.0: Pending analysis
Last modification:
28/08/2026
Subscribe to Vulnerabilities