Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-7203

Publication date:

28/04/2026

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used.

Severity CVSS v4.0: HIGH

Last modification:

28/04/2026

CVE-2026-7204

Publication date:

28/04/2026

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Severity CVSS v4.0: HIGH

Last modification:

28/04/2026

CVE-2026-7205

Publication date:

28/04/2026

A vulnerability was identified in duartium papers-mcp-server 9ceb3812a6458ba7922ca24a7406f8807bc55598. Impacted is the function search_papers of the file src/main.py. Such manipulation of the argument topic leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Severity CVSS v4.0: MEDIUM

Last modification:

29/04/2026

CVE-2026-20766

Publication date:

28/04/2026

An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.

Severity CVSS v4.0: HIGH

Last modification:

28/04/2026

CVE-2026-32644

Publication date:

28/04/2026

Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.

Severity CVSS v4.0: CRITICAL

Last modification:

28/04/2026

CVE-2026-32649

Publication date:

28/04/2026

A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.

Severity CVSS v4.0: HIGH

Last modification:

28/04/2026

CVE-2026-7200

Publication date:

28/04/2026

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php?page=types. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used.

Severity CVSS v4.0: LOW

Last modification:

29/04/2026

CVE-2026-41370

Publication date:

28/04/2026

OpenClaw before 2026.3.31 contains a path traversal vulnerability in ACP dispatch that allows attackers to read arbitrary files by manipulating inbound channel attachment paths. Remote attackers can bypass attachment-cache and root directory checks to access files outside intended directories.

Severity CVSS v4.0: HIGH

Last modification:

28/04/2026

CVE-2026-41372

Publication date:

28/04/2026

OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.

Severity CVSS v4.0: MEDIUM

Last modification:

28/04/2026

CVE-2026-41371

Publication date:

28/04/2026

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and force new session IDs without requiring admin scope by exploiting improper authorization checks in the chat.send path.

Severity CVSS v4.0: HIGH

Last modification:

28/04/2026

CVE-2026-41369

Publication date:

28/04/2026

OpenClaw before 2026.3.31 contains insufficient environment variable sanitization in host exec operations, failing to filter package, registry, Docker, compiler, and TLS override variables. Attackers can exploit this by injecting malicious environment variables to override critical system configurations and compromise host execution integrity.

Severity CVSS v4.0: HIGH

Last modification:

28/04/2026

CVE-2026-41368

Publication date:

28/04/2026

OpenClaw before 2026.3.28 contains an environment variable disclosure vulnerability in the jq safe-bin policy that fails to block the $ENV filter. Attackers can bypass safe-bin restrictions by using $ENV in jq programs to access sensitive environment variables that should be restricted.

Severity CVSS v4.0: HIGH

Last modification:

28/04/2026

Subscribe to Vulnerabilities