Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-13721

Publication date:

11/11/2026

A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they only had view access, through the provisioning files API (incorrect authorization).

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-14242

Publication date:

11/11/2026

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization).

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-124746

Publication date:

11/11/2026

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-123710

Publication date:

11/11/2026

A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-119618

Publication date:

11/11/2026

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server&#39;s mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-109163

Publication date:

11/11/2026

Stack-based buffer overflow vulnerability in Apache HTTP Server&#39;s mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-110289

Publication date:

11/11/2026

A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection&#39;s OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-110992

Publication date:

11/11/2026

A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-111000

Publication date:

11/11/2026

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management).

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-111024

Publication date:

11/11/2026

A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-106023

Publication date:

11/11/2026

NULL pointer dereference vulnerability in Apache HTTP Server&#39;s mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

CVE-2026-107509

Publication date:

11/11/2026

A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).

Severity CVSS v4.0: Pending analysis

Last modification:

11/11/2026

Subscribe to Vulnerabilities