Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-24299

Publication date:

19/03/2026

Improper neutralization of special elements used in a command (&#39;command injection&#39;) in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2026

CVE-2026-23659

Publication date:

19/03/2026

Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2026-23658

Publication date:

19/03/2026

Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2026-3579

Publication date:

19/03/2026

wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted __muldi3 subroutine executes in variable time based on operand values. This affects multiple SP math functions (sp_256_mul_9, sp_256_sqr_9, etc.), leading to a timing side-channel that may expose sensitive cryptographic data.

Severity CVSS v4.0: LOW

Last modification:

23/03/2026

CVE-2026-3580

Publication date:

19/03/2026

In wolfSSL 5.8.4, constant-time masking logic in sp_256_get_entry_256_9 is optimized into conditional branches (bnez) by GCC when targeting RISC-V RV32I with -O3. This transformation breaks the side-channel resistance of ECC scalar multiplication, potentially allowing a local attacker to recover secret keys via timing analysis.

Severity CVSS v4.0: LOW

Last modification:

23/03/2026

CVE-2026-32238

Publication date:

19/03/2026

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 contain a Command injection vulnerability in the backup functionality that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the backup functionality. Version 8.0.0.2 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-25744

Publication date:

19/03/2026

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the encounter vitals API accepts an `id` in the request body and treats it as an UPDATE. There is no verification that the vital belongs to the current patient or encounter. An authenticated user with encounters/notes permission can overwrite any patient&#39;s vitals by supplying another patient&#39;s vital `id`, leading to medical record tampering. Version 8.0.0.2 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-25928

Publication date:

19/03/2026

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-32119

Publication date:

19/03/2026

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored XSS in the jQuery SearchHighlight plugin (`library/js/SearchHighlight.js`) allows an authenticated user with encounter form write access to inject arbitrary JavaScript that executes in another clinician&#39;s browser session when they use the search/find feature on the Custom Report page. The plugin reverses server-side HTML entity encoding by reading decoded text from DOM text nodes, concatenating it into a raw HTML string, and passing it to jQuery&#39;s `$()` constructor for HTML parsing. Version 8.0.0.2 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-3503

Publication date:

19/03/2026

Protection mechanism failure in wolfCrypt post-quantum implementations (ML-KEM and ML-DSA) in wolfSSL on ARM Cortex-M microcontrollers allows a physical attacker to compromise key material and/or cryptographic outcomes via induced transient faults that corrupt or redirect seed/pointer values during Keccak-based expansion. This issue affects wolfSSL (wolfCrypt): commit hash d86575c766e6e67ef93545fa69c04d6eb49400c6.

Severity CVSS v4.0: MEDIUM

Last modification:

20/03/2026

CVE-2026-25667

Publication date:

19/03/2026

ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2026

CVE-2026-2645

Publication date:

19/03/2026

In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 (wolfSSL 5.8.2 and earlier is vulnerable, 5.8.4 is not vulnerable). In 5.8.4 wolfSSL would detect the issue later in the handshake. 5.9.0 was further hardened to catch the issue earlier in the handshake.

Severity CVSS v4.0: MEDIUM

Last modification:

20/03/2026

Subscribe to Vulnerabilities