Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-66009
Publication date:
24/07/2026
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application id — with no user session, master key, or maintenance key — can trigger validation errors to learn the names of required (non-null) custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.
Severity CVSS v4.0: MEDIUM
Last modification:
30/07/2026

CVE-2026-66010
Publication date:
24/07/2026
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.
Severity CVSS v4.0: MEDIUM
Last modification:
30/07/2026

CVE-2026-46452
Publication date:
24/07/2026
Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resulting in memory pressure and unstable parsing behavior.<br /> <br /> This issue affects Apache NimBLE: through 1.9.0.<br /> <br /> Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-45816
Publication date:
24/07/2026
NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event.<br /> <br /> This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low.<br /> <br /> This issue affects Apache NimBLE: through 1.9.0.<br /> <br /> Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-45815
Publication date:
24/07/2026
Reachable Assertion vulnerability in Apache NimBLE.<br /> A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser.<br /> <br /> Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request.<br /> <br /> This issue affects Apache NimBLE: through 1.9.0.<br /> <br /> Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-45813
Publication date:
24/07/2026
Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service.<br /> Improper validation when parsing BASS service  "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read.<br /> <br /> <br /> This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, which depending on device configuration may or may not require user action.<br /> <br /> This issue affects Apache NimBLE: through 1.9.0.<br /> <br /> Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-45812
Publication date:
24/07/2026
Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event.<br /> <br /> When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the buffer and deliver a GAP event with bogus data to the application.<br /> <br /> Severity is low: NimBLE&amp;#39;s own controller never batches multiple reports into one event, so this only matters when NimBLE&amp;#39;s host is paired with a third-party controller that does.<br /> <br /> This issue affects Apache NimBLE: through 1.9.0.<br /> <br /> Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-45811
Publication date:
24/07/2026
Buffer Copy without Checking Size of Input (&amp;#39;Classic Buffer Overflow&amp;#39;) vulnerability in Apache NimBLE.<br /> The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either a misconfigured pool size or a malicious/compromised controller on the other end of the HCI socket link, not over-the-air Bluetooth access.<br /> <br /> This issue affects Apache NimBLE: through 1.9.0.<br /> <br /> Users are recommended to upgrade to version 1.10.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-16743
Publication date:
24/07/2026
A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.
Severity CVSS v4.0: Pending analysis
Last modification:
24/07/2026

CVE-2026-16730
Publication date:
24/07/2026
A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.
Severity CVSS v4.0: Pending analysis
Last modification:
24/07/2026

CVE-2026-15810
Publication date:
24/07/2026
A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a maliciously crafted URL.<br /> <br /> <br /> Looker-hosted and Self-hosted were found to be vulnerable.<br /> This issue has already been mitigated for Looker-hosted instances. No user action is required for these.<br /> <br /> <br /> Self-hosted instances must be upgraded to the patched versions: 25.6.103+, 25.12.65+, 25.18.68+, 26.0.66+, 26.2.47+, 26.4.36+, 26.6.28+, or 26.8.7+.
Severity CVSS v4.0: HIGH
Last modification:
27/07/2026

CVE-2026-15243
Publication date:
24/07/2026
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim. <br /> <br /> <br /> Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.
Severity CVSS v4.0: HIGH
Last modification:
30/07/2026
Subscribe to Vulnerabilities