Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-64266
Publication date:
25/07/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse: re-lock request before returning from fuse_ref_folio()<br /> <br /> fuse_ref_folio() unlocks the request but does not re-lock it before<br /> returning. fuse_chan_abort() can end the request and the async end<br /> callback (eg fuse_writepage_free()) can free the args while the<br /> subsequent copy chain logic after fuse_ref_folio() accesses them,<br /> leading to use-after-free issues.<br /> <br /> Fix this by locking the request in fuse_ref_folio() before returning.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-64267
Publication date:
25/07/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse: avoid 32-bit prune notification count wrap<br /> <br /> FUSE_NOTIFY_PRUNE validates the nodeid payload length with:<br /> <br /> size - sizeof(outarg) != outarg.count * sizeof(u64)<br /> <br /> On 32-bit kernels, size_t is also 32 bits, so the daemon-controlled<br /> count multiplication can wrap. A prune notification with count<br /> 0x20000000 and no nodeid payload passes the check, enters the copy<br /> loop, and asks the device copy path to read nodeids that are not<br /> present in the userspace write buffer. In QEMU this reaches the<br /> fuse_copy_fill() BUG_ON(!err) path.<br /> <br /> Validate the payload length with array_size() instead. That accepts<br /> exactly the same valid messages, but avoids wrapping arithmetic before<br /> the copy loop consumes the count.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-64257
Publication date:
25/07/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: reject overlapping data areas in SMB2 responses<br /> <br /> Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to<br /> responses without data area") restricted the implied bcc[0] length<br /> exception to responses without a data area. However, the overlap<br /> handling in __smb2_calc_size() clears data_length, which can make an<br /> invalid response appear to have no data area and so qualify for the<br /> exception.<br /> <br /> Track data area overlap separately and reject such responses before<br /> applying the length compatibility exceptions.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-64258
Publication date:
25/07/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref<br /> <br /> If a copy into the userspace ring buffer fails, a request will be<br /> terminated and fuse_uring_req_end() will set ent-&gt;fuse_req to NULL but<br /> it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This<br /> can lead to a NULL deref if the request expiration logic scans<br /> ent_w_req_queue in the window before the entry is moved off it.<br /> <br /> Fix this by taking the entry off ent_w_req_queue and changing its state<br /> from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-64256
Publication date:
25/07/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: don&amp;#39;t wrap around quota ids in dqiterate<br /> <br /> LOLLM noticed that q_id is an unsigned 32-bit variable. If it happens<br /> to be set to XFS_DQ_ID_MAX due to a filesystem that actually has a dquot<br /> for ID_MAX, then this addition will truncate to zero and the iteration<br /> starts over. Fix this by casting to u64.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-16766
Publication date:
25/07/2026
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options.<br /> <br /> Options are passed directly to the wkhtmltopdf command without sanitization.<br /> <br /> Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection.<br /> <br /> Version 0.6.0 was released with an incomplete fix for this issue.<br /> <br /> Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.
Severity CVSS v4.0: Pending analysis
Last modification:
28/07/2026

CVE-2026-14955
Publication date:
25/07/2026
The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the &amp;#39;thwcfe_legacy_file&amp;#39; parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-15425
Publication date:
25/07/2026
The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug (post_name) in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires pretty permalinks to be enabled, as the exploit chain depends on get_permalink() embedding the stored percent-encoded post_name in the generated URL.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-10818
Publication date:
25/07/2026
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the assembled file not being deleted upon validation failure. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-66373
Publication date:
25/07/2026
Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
Severity CVSS v4.0: Pending analysis
Last modification:
28/07/2026

CVE-2026-66374
Publication date:
25/07/2026
Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-66338
Publication date:
24/07/2026
A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026
Subscribe to Vulnerabilities