Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-63358

Publication date:

21/07/2026

FileGator accepts arbitrary Unix permission values via the &#39;/chmoditems&#39; API endpoint and passes the value directly to PHP&#39;s native &#39;chmod()&#39; function through &#39;octdec()&#39; conversion, with no validation. This allows an authenticated user with &#39;chmod&#39; permission to upgrade their privileges to root.

Severity CVSS v4.0: HIGH

Last modification:

22/07/2026

CVE-2026-64881

Publication date:

21/07/2026

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

Severity CVSS v4.0: HIGH

Last modification:

24/07/2026

CVE-2026-63764

Publication date:

21/07/2026

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an attacker-controlled host that returns a redirect to a private IP or cloud-metadata endpoint, causing the server to follow the redirect and expose internal service content through the model pipeline.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-63080

Publication date:

21/07/2026

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters to inject a UNION ALL statement that bypasses the app_id tenant isolation filter across thirteen of the fifteen stats API endpoints.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-56147

Publication date:

21/07/2026

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise via Privilege Abuse (CAPEC-122). An inconsistency in Kibana&#39;s file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments that belong to feature areas they are not authorized to access. Because the access control check and the resource retrieval use different resolution mechanisms, an authenticated attacker with limited file management permissions can obtain the contents of, modify, or delete protected case attachments — such as those associated with Security Solution cases — without holding the privileges required to access those features.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-63136

Publication date:

21/07/2026

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-63139

Publication date:

21/07/2026

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana&#39;s Canvas functionality by sending a specially crafted request, causing the Kibana server process to terminate and resulting in a denial of service for all users of the affected Kibana instance.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-52474

Publication date:

21/07/2026

An issue in aiflowy

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-52475

Publication date:

21/07/2026

Cross Site Scripting vulnerability in aiflowy

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-52476

Publication date:

21/07/2026

SQL Injection vulnerability in aiflowy

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-63092

Publication date:

21/07/2026

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin&#39;s activate dialog handler in lib/areas.php returns the complete key via ModulesLicense::readKey() without performing an administrator check, as the dialog is gated only by the access.system permission which defaults to true for all non-admin roles, enabling attackers to use the disclosed key to activate the plugin on arbitrary third-party installations.

Severity CVSS v4.0: MEDIUM

Last modification:

23/07/2026

CVE-2026-47697

Publication date:

21/07/2026

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller&#39;s organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org B&#39;s data across organization boundaries (a cross-tenant IDOR). A loader-only restriction on personal-workspace bookings was also bypassable via a crafted POST. Version 1.20.2 patches the issue. No known workarounds are available.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

Subscribe to Vulnerabilities