Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-11721

Publication date:

22/07/2026

It is possible for an attacker&#39;s zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker&#39;s zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (which is the default).<br /> This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-12617

Publication date:

22/07/2026

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur.<br /> This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2026

CVE-2026-56444

Publication date:

22/07/2026

In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with &#39;serve-expired: yes&#39; and &#39;serve-expired-client-timeout > discard-timeout > 0&#39; (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for &#39;serve-expired-client-timeout: 1800&#39; and &#39;discard-timeout: 1900&#39; make the branch unreachable.

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-56416

Publication date:

22/07/2026

In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as &#39;datstart + dname_valid(datstart, ...)&#39; and passes it straight to &#39;query_dname_tolower()&#39; without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause &#39;query_dname_tolower()&#39; to walk label-by-label through stale bytes in the per-worker &#39;env->scratch_buffer&#39;, past the end of that heap allocation if &#39;msg-buffer-size&#39; has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-62144

Publication date:

22/07/2026

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-62145

Publication date:

22/07/2026

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-54478

Publication date:

22/07/2026

In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a &#39;proxy-protocol-port&#39; interface with &#39;answer-cookie: yes&#39;, the RFC 9018 server-cookie SipHash is computed over the proxy&#39;s wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-55708

Publication date:

22/07/2026

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the &#39;view_local_data&#39; and &#39;view_local_datas&#39; commands of &#39;unbound-control&#39; create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-55717

Publication date:

22/07/2026

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when &#39;serve-expired: yes&#39; is set together with a &#39;response-ip: redirect&#39; /&#39;response-ip-data: CNAME &#39; rule (or the RPZ &#39;rpz-cname-override&#39; equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets &#39;alias_rrset&#39; but not &#39;partial_rep&#39;. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of &#39;serve-expired-client-timeout&#39; is taken leading to denial of service via the server crash.

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-55973

Publication date:

22/07/2026

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when &#39;dns-error-reporting: yes&#39; is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option&#39;s length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic &#39;_er.&#39; report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during &#39;find_closest_of_type()&#39;, it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to &#39;dname_query_hash()&#39; as a label length writing over the stack variable &#39;labuf&#39;. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-55990

Publication date:

22/07/2026

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the &#39;dnscrypt:&#39; clause lists more &#39;dnscrypt-provider-cert:&#39; files than there are matching &#39;dnscrypt-secret-key:&#39; files, Unbound fills only the matched prefix and leaves the tail slots at the &#39;0xdb&#39; fill that libsodium&#39;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with &#39;0xdb&#39; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are &#39;0xdb&#39; to &#39;dnscrypt-port&#39; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (&#39;--enable-dnscrypt&#39;).

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

CVE-2026-55991

Publication date:

22/07/2026

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When &#39;ngtcp2_conn_writev_stream()&#39; returns &#39;NGTCP2_ERR_STREAM_DATA_BLOCKED&#39;, Unbound continues to call &#39;ngtcp2_ccerr_set_application_error()&#39; with a &#39;-1&#39; error value. The &#39;int&#39; literal &#39;-1&#39; is implicitly converted to the function&#39;s &#39;uint64_t error_code&#39; parameter as &#39;0xFFFFFFFFFFFFFFFF&#39;. The follow-on &#39;ngtcp2_conn_write_connection_close()&#39; serialises that value as a QUIC variable-length integer; because &#39;2^64-1&#39; exceeds the 62-bit varint ceiling, &#39;ngtcp2_put_uvarintlen()&#39; fails &#39;assert(n

Severity CVSS v4.0: Pending analysis

Last modification:

24/07/2026

Subscribe to Vulnerabilities