Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-4928
Publication date:
04/05/2026
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2026

CVE-2026-6266
Publication date:
04/05/2026
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a remote attacker to potentially hijack a victim's account or gain unauthorized access to other accounts, including administrative accounts, by manipulating the IDP-provided email.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2026

CVE-2026-34032
Publication date:
04/05/2026
Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.<br /> <br /> This issue affects Apache HTTP Server: through 2.4.66.<br /> <br /> Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2026

CVE-2026-33857
Publication date:
04/05/2026
Out-of-bounds Read vulnerability in mod_proxy_ajp of <br /> <br /> Apache HTTP Server.<br /> <br /> This issue affects Apache HTTP Server: through 2.4.66.<br /> <br /> Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2026

CVE-2026-31205
Publication date:
04/05/2026
Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent function
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2026

CVE-2025-70067
Publication date:
04/05/2026
Buffer Overflow vulnerability exists in Assimp versions up to 6.0.2 in the FBX Importer. The vulnerability occurs in aiMaterial::AddBinaryProperty, where a property key string from a crafted FBX file is copied into a fixed-size heap buffer using strcpy() without runtime length validation
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2026

CVE-2025-70069
Publication date:
04/05/2026
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2026

CVE-2025-58074
Publication date:
04/05/2026
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files that can lead to elevation of privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2026

CVE-2026-7482
Publication date:
04/05/2026
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file&amp;#39;s actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users&amp;#39; conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).
Severity CVSS v4.0: HIGH
Last modification:
11/05/2026

CVE-2026-34059
Publication date:
04/05/2026
Buffer Over-read vulnerability in Apache HTTP Server.<br /> <br /> This issue affects Apache HTTP Server: through 2.4.66.<br /> <br /> Users are recommended to upgrade to version 2.4.67, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2026

CVE-2026-24072
Publication date:
04/05/2026
An escalation of privilege bug in various modules in Apache HTTP 2.4.66 and earlier allows local .htaccess authors to read files with the privileges of the httpd user.<br /> <br /> Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
04/05/2026

CVE-2026-3120
Publication date:
04/05/2026
Improper Control of Generation of Code (&amp;#39;Code Injection&amp;#39;) vulnerability in Profelis Information and Consulting Trade and Industry Limited Company SambaBox allows OS Command Injection.<br /> <br /> This issue affects SambaBox: from 5.1 before 5.3.
Severity CVSS v4.0: Pending analysis
Last modification:
05/05/2026
Subscribe to Vulnerabilities