Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-28394
Publication date:
05/03/2026
OpenClaw versions prior to 2026.2.15 contain a denial of service vulnerability in the web_fetch tool that allows attackers to crash the Gateway process through memory exhaustion by parsing oversized or deeply nested HTML responses. Remote attackers can social-engineer users into fetching malicious URLs with pathological HTML structures to exhaust server memory and cause service unavailability.
Severity CVSS v4.0: MEDIUM
Last modification:
05/03/2026

CVE-2026-28391
Publication date:
05/03/2026
OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests (non-default configuration), allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like & or %...% to execute unapproved commands beyond the allowlisted operations.
Severity CVSS v4.0: CRITICAL
Last modification:
06/03/2026

CVE-2026-28392
Publication date:
05/03/2026
OpenClaw versions prior to 2026.2.14 contain a privilege escalation vulnerability in the Slack slash-command handler that incorrectly authorizes any direct message sender when dmPolicy is set to open (must be configured). Attackers can execute privileged slash commands via direct message to bypass allowlist and access-group restrictions.
Severity CVSS v4.0: HIGH
Last modification:
06/03/2026

CVE-2026-28393
Publication date:
05/03/2026
OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings[].transform.module parameter accepts absolute paths and traversal sequences, enabling attackers with configuration write access to load and execute malicious modules with gateway process privileges.
Severity CVSS v4.0: HIGH
Last modification:
06/03/2026

CVE-2026-21622
Publication date:
05/03/2026
Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm (&amp;#39;Elixir.Hexpm.Accounts.PasswordReset&amp;#39; module) allows Account Takeover.<br /> <br /> Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced.<br /> <br /> If a user&amp;#39;s historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim&amp;#39;s password. The attacker does not need current access to the victim&amp;#39;s email account, only access to a previously leaked copy of the reset email.<br /> <br /> This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines &amp;#39;Elixir.Hexpm.Accounts.PasswordReset&amp;#39;:can_reset?/3.<br /> <br /> This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.
Severity CVSS v4.0: CRITICAL
Last modification:
05/03/2026

CVE-2026-29188
Publication date:
05/03/2026
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.
Severity CVSS v4.0: Pending analysis
Last modification:
05/03/2026

CVE-2026-28413
Publication date:
05/03/2026
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.
Severity CVSS v4.0: Pending analysis
Last modification:
05/03/2026

CVE-2026-28436
Publication date:
05/03/2026
Frappe is a full-stack web application framework. Prior to versions 16.11.0 and 15.102.0, an attacker can set a crafted image URL that results in XSS when the avatar is displayed, and it can be triggered for other users via website page comments. This issue has been patched in versions 16.11.0 and 15.102.0.
Severity CVSS v4.0: MEDIUM
Last modification:
05/03/2026

CVE-2026-28443
Publication date:
05/03/2026
OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.
Severity CVSS v4.0: MEDIUM
Last modification:
05/03/2026

CVE-2026-28492
Publication date:
05/03/2026
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.0, when a user creates a public share link for a directory, the withHashFile middleware in http/public.go uses filepath.Dir(link.Path) to compute the BasePathFs root. This sets the filesystem root to the parent directory instead of the shared directory itself, allowing anyone with the share link to browse and download files from all sibling directories. This issue has been patched in version 2.61.0.
Severity CVSS v4.0: HIGH
Last modification:
05/03/2026

CVE-2026-29077
Publication date:
05/03/2026
Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn&amp;#39;t have. This issue has been patched in versions 15.98.0 and 14.100.0.
Severity CVSS v4.0: Pending analysis
Last modification:
05/03/2026

CVE-2026-29081
Publication date:
05/03/2026
Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafted requests, which would allow a malicious actor to extract sensitive information. This issue has been patched in versions 14.100.1 and 15.100.0.
Severity CVSS v4.0: Pending analysis
Last modification:
05/03/2026
Subscribe to Vulnerabilities