Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-53414

Publication date:

11/08/2026

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-53416

Publication date:

11/08/2026

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-48766

Publication date:

11/08/2026

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both `apiKey` and the explicit `api-key` header, and then sends the outbound request to the caller-supplied URL. Because the permission check accepts any readable workspace member and `listCredentials` reveals credential identifiers to guests, a guest can force the server to deliver the workspace secret to attacker infrastructure. Version 3.17.0 patches the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2026

CVE-2026-53413

Publication date:

11/08/2026

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2026

CVE-2026-53415

Publication date:

11/08/2026

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.

Severity CVSS v4.0: Pending analysis

Last modification:

13/08/2026

CVE-2026-48495

Publication date:

11/08/2026

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

13/08/2026

CVE-2026-42142

Publication date:

11/08/2026

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace&#39;s Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-19078

Publication date:

11/08/2026

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the &#39;then&#39; parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website. This could enable phishing attacks, potentially tricking users into revealing sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

14/08/2026

CVE-2026-19546

Publication date:

11/08/2026

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.<br /> <br /> For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.

Severity CVSS v4.0: Pending analysis

Last modification:

14/08/2026

CVE-2026-18638

Publication date:

11/08/2026

Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-18639

Publication date:

11/08/2026

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.<br /> <br /> This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-18640

Publication date:

11/08/2026

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org&#39;s data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

Subscribe to Vulnerabilities