Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-81721

Publication date:

27/08/2026

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81707

Publication date:

27/08/2026

openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks.

Severity CVSS v4.0: CRITICAL

Last modification:

27/08/2026

CVE-2026-81715

Publication date:

27/08/2026

openssl_encrypt (pip package openssl-encrypt) versions

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81705

Publication date:

27/08/2026

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact option names, --option=value forms, and tokens starting with -p, so these spellings bypass the redaction chokepoint and the cleartext password is written to stderr. Anyone with access to that output (terminal scrollback, merged 2>&1 output, CI job logs, or the GUI&#39;s persistent debug log) can recover the password.

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81706

Publication date:

27/08/2026

openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the corresponding own identity is deleted. When the own identity is deleted, the shadowed contact becomes visible and resolves to the attacker&#39;s keys, enabling silent key substitution for encrypted files.

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

CVE-2026-81714

Publication date:

27/08/2026

openssl_encrypt (pip: openssl-encrypt) versions

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

CVE-2026-81716

Publication date:

27/08/2026

openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ_FILES permission could read or write another plugin&#39;s directory that merely shares a name prefix (e.g., .../plugins/foobar matching allowed .../plugins/foo), breaking per-plugin isolation within the same user. Fixed by matching each allowed directory exactly or with a trailing path separator.

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81702

Publication date:

27/08/2026

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Severity CVSS v4.0: CRITICAL

Last modification:

27/08/2026

CVE-2026-81699

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81704

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81698

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command&#39;s reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

CVE-2026-81700

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

Subscribe to Vulnerabilities