Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-78633

Publication date:

13/10/2026

The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the parser to loop indefinitely, resulting in worker-thread exhaustion and denial of new RADIUS authentication requests.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-70189

Publication date:

13/10/2026

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-65674

Publication date:

13/10/2026

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-67625

Publication date:

13/10/2026

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-67626

Publication date:

13/10/2026

Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-67628

Publication date:

13/10/2026

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-68883

Publication date:

13/10/2026

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-63168

Publication date:

13/10/2026

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

13/10/2026

CVE-2026-63169

Publication date:

13/10/2026

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger&#39;s HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and framed JavaScript execution in recipients&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

13/10/2026

CVE-2026-62840

Publication date:

13/10/2026

Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-104587

Publication date:

13/10/2026

blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim&#39;s browser context when rendered in the local web interface.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-86016

Publication date:

13/10/2026

VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

Subscribe to Vulnerabilities