Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-81701

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic keys.

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

CVE-2026-81703

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false integrity verification.

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81692

Publication date:

27/08/2026

openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during &#39;decrypt --stego-extract&#39;. The issue is fixed in 1.4.9; both the 1.4.x and 1.5.x lines are affected.

Severity CVSS v4.0: HIGH

Last modification:

27/08/2026

CVE-2026-81697

Publication date:

27/08/2026

openssl_encrypt (pip package openssl-encrypt) versions

Severity CVSS v4.0: HIGH

Last modification:

27/08/2026

CVE-2026-81694

Publication date:

27/08/2026

openssl-encrypt (pip package, versions

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

CVE-2026-81693

Publication date:

27/08/2026

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81695

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

CVE-2026-81696

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

CVE-2026-81687

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 fail to enforce a time ceiling on key derivation function iteration counts specified in file metadata. Attackers can craft files with extremely high KDF iteration counts to consume CPU resources for unbounded periods before password verification occurs.

Severity CVSS v4.0: HIGH

Last modification:

27/08/2026

CVE-2026-81689

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.

Severity CVSS v4.0: HIGH

Last modification:

28/08/2026

CVE-2026-81685

Publication date:

27/08/2026

openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.

Severity CVSS v4.0: CRITICAL

Last modification:

28/08/2026

CVE-2026-81686

Publication date:

27/08/2026

openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.

Severity CVSS v4.0: MEDIUM

Last modification:

28/08/2026

Subscribe to Vulnerabilities