Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-47364

Publication date:

02/02/2026

Memory corruption while calculating offset from partition start point.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2025-14914

Publication date:

02/02/2026

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2026-1703

Publication date:

02/02/2026

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn&#39;t able to inject or overwrite executable files in typical situations.

Severity CVSS v4.0: LOW

Last modification:

03/02/2026

CVE-2022-50980

Publication date:

02/02/2026

A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2026

CVE-2022-50981

Publication date:

02/02/2026

An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2026

CVE-2022-50976

Publication date:

02/02/2026

A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2026

CVE-2022-50977

Publication date:

02/02/2026

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2026

CVE-2022-50978

Publication date:

02/02/2026

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP).

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2026

CVE-2022-50979

Publication date:

02/02/2026

An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS485).

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2026

CVE-2022-50975

Publication date:

02/02/2026

An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configuration via ethernet is enabled.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2026

CVE-2026-24070

Publication date:

02/02/2026

During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is deployed as well. The communication with the XPC service of the privileged helper is only allowed if the client process is signed with the corresponding certificate and fulfills the following code signing requirement:<br /> "anchor trusted and certificate leaf[subject.CN] = \"Developer ID Application: Native Instruments GmbH (83K5EG6Z9V)\""<br /> <br /> The Native Access application was found to be signed with the `com.apple.security.cs.allow-dyld-environment-variables` and `com.apple.security.cs.disable-library-validation` entitlements leading to DYLIB injection and therefore command execution in the context of this application. A low privileged user can exploit the DYLIB injection to trigger functions of the privileged helper XPC service resulting in privilege escalation by first deleting the /etc/sudoers file and then copying a malicious version of that file to /etc/sudoers.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2026-24071

Publication date:

02/02/2026

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler function uses _xpc_connection_get_pid(arg2) as argument for the hasValidSignature function. This value can not be trusted since it is vulnerable to PID reuse attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

Subscribe to Vulnerabilities