Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-9177

Publication date:

29/07/2026

A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code expressions, which are executed server-side when the template is rendered (i.e., during email sending). Successful exploitation of this flaw allows an attacker to execute arbitrary code on the server that results in full host compromise. This issue affects all Axway SecureTransport versions prior 5.5-20260528 update.

Severity CVSS v4.0: CRITICAL

Last modification:

30/07/2026

CVE-2026-67217

Publication date:

29/07/2026

cJSON through 1.7.19 applies RFC 6902 JSON Patch operations non-atomically in apply_patch() in cJSON_Utils.c. For a replace operation that is missing its value member, or a move operation whose destination path cannot be resolved, the existing target member is detached and deleted before the operation is fully validated, so the target document is mutated while cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() returns a failure status. An attacker who can supply the patch document can destroy addressable members of the target document even though the API reports that the patch failed, defeating the all-or-nothing behavior callers rely on to reject bad patches.

Severity CVSS v4.0: MEDIUM

Last modification:

04/08/2026

CVE-2026-67216

Publication date:

29/07/2026

cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When comparing objects, the function recurses into each shared subtree twice, once in each direction, with no depth guard, making the running time exponential in nesting depth. A small, deeply nested document of a few hundred bytes (depth around 40) compared for equality consumes hours of CPU, and the cost roughly doubles with each additional level of nesting. An application that calls cJSON_Compare() on attacker-influenced JSON that is structurally equal to a reference document is exposed to a denial-of-service condition.

Severity CVSS v4.0: HIGH

Last modification:

04/08/2026

CVE-2026-67215

Publication date:

29/07/2026

cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an untrusted RFC 6902 JSON Patch is applied via cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive(). A patch containing add and copy operations grafts duplicated subtrees to amplify document depth beyond the parser&#39;s nesting limit: cJSON_Delete() recurses with no depth bound, and the cJSON_Duplicate() guard CJSON_CIRCULAR_LIMIT is set to 10000, ten times the parser&#39;s 1000-level nesting limit and high enough to overflow a default thread stack. An attacker who can supply the patch document can crash the process, resulting in denial of service.

Severity CVSS v4.0: HIGH

Last modification:

04/08/2026

CVE-2026-66400

Publication date:

29/07/2026

Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluates incorrectly in PHP.

Severity CVSS v4.0: MEDIUM

Last modification:

30/07/2026

CVE-2026-67213

Publication date:

29/07/2026

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Severity CVSS v4.0: HIGH

Last modification:

30/07/2026

CVE-2026-66490

Publication date:

29/07/2026

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2026

CVE-2026-66489

Publication date:

29/07/2026

Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2026

CVE-2026-66488

Publication date:

29/07/2026

Joomla Extension - balbooa.com - Payment bypass in Gridbox

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2026

CVE-2026-65890

Publication date:

29/07/2026

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox

Severity CVSS v4.0: CRITICAL

Last modification:

05/08/2026

CVE-2026-65889

Publication date:

29/07/2026

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion

Severity CVSS v4.0: CRITICAL

Last modification:

05/08/2026

CVE-2026-55995

Publication date:

29/07/2026

A Double Free vulnerability in open-iscsi allows an unauthenticated MITM attacker to cause DoS. This issue affects open-iscsi: from ? through 56718d4e9d1a4f51c30697b5c0534144bb41c9bb.

Severity CVSS v4.0: HIGH

Last modification:

30/07/2026

Subscribe to Vulnerabilities