Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-27510

Publication date:

26/02/2026

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot&#39;s actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application&#39;s community marketplace can result in arbitrary code execution on any robot that imports and runs it.

Severity CVSS v4.0: MEDIUM

Last modification:

27/02/2026

CVE-2026-27141

Publication date:

26/02/2026

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-26973

Publication date:

26/02/2026

Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `ReviewableNotesController`. When `enable_category_group_moderation` is enabled, a user belonging to a category moderation group can create or delete their own notes on **any** reviewable in the system, including reviewables in categories they do not moderate. The controller used an unscoped `Reviewable.find` and the `ensure_can_see` guard only checked whether the user could access the review queue in general, not whether they could access the specific reviewable. Only instances with `enable_category_group_moderation` enabled are affected. Staff users (admins/moderators) are not impacted as they already have access to all reviewables. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by scoping the reviewable lookup through `Reviewable.viewable_by(current_user)`. As a workaround, disable the `enable_category_group_moderation` site setting. This removes the attack surface as only staff users will have access to the review queue.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-26979

Publication date:

26/02/2026

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don&#39;t have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Severity CVSS v4.0: NONE

Last modification:

27/02/2026

CVE-2026-23939

Publication date:

26/02/2026

Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in hexpm hexpm/hexpm (&#39;Elixir.Hexpm.Store.Local&#39; module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines &#39;Elixir.Hexpm.Store.Local&#39;:get/3, &#39;Elixir.Hexpm.Store.Local&#39;:put/4, &#39;Elixir.Hexpm.Store.Local&#39;:delete/2, &#39;Elixir.Hexpm.Store.Local&#39;:delete_many/2.<br /> <br /> This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.<br /> <br /> This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.

Severity CVSS v4.0: MEDIUM

Last modification:

27/02/2026

CVE-2026-1565

Publication date:

26/02/2026

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the &#39;WPUF_Admin_Settings::check_filetype_and_ext&#39; function and in the &#39;Admin_Tools::check_filetype_and_ext&#39; function in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-1241

Publication date:

26/02/2026

The Pelco, Inc. Sarix Professional 3 Series Cameras are vulnerable to an authentication bypass issue in their web management interface. The flaw stems from inadequate enforcement of access controls, allowing certain functionality to be accessed without proper authentication. This weakness can lead to unauthorized viewing of live video streams, creating privacy concerns and operational risks for organizations relying on these cameras. Additionally, it may expose operators to regulatory and compliance challenges.

Severity CVSS v4.0: HIGH

Last modification:

27/02/2026