Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-41292

Publication date:

20/05/2026

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options. An adversary sending queries with too many EDNS options can hold Unbound threads hostage while they are parsing and creating internal data structures for the options. Coordinated attacks can result in degradation and/or denial of service. Unbound 1.25.1 contains a patch with a fix to limit acceptable incoming EDNS options (100).

Severity CVSS v4.0: MEDIUM

Last modification:

20/05/2026

CVE-2026-42534

Publication date:

20/05/2026

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the jostle logic that could defeat its purpose and degrade resolution performance. Retransmits of the same query could renew the age of slow running queries and not allow the jostle logic to see them as aged and potential targets for replacement with new queries. An adversary who can query a vulnerable Unbound and who can control a domain name server that replies slowly and/or maliciously to Unbound&#39;s queries can exploit the vulnerability and degrade the resolution performance of Unbound. When Unbound&#39;s &#39;num-queries-per-thread&#39; reaches its limit, the jostle logic kicks in. When a new query comes in, half of the available queries that are also slow to resolve are candidates for replacement. The vulnerability then happens because duplicate queries that need resolution would skew the aging result by using the timestamp of the latest duplicate query instead of the original one that started the resolution effort. Cache and local data response performance remains unaffected. Coordinated attacks could raise this to a denial of resolution service. Unbound 1.25.1 contains a patch with a fix to attach an initial, non-updatable start time for incoming queries that allow the jostle logic to work as intended.

Severity CVSS v4.0: MEDIUM

Last modification:

20/05/2026

CVE-2026-42923

Publication date:

20/05/2026

NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.

Severity CVSS v4.0: MEDIUM

Last modification:

20/05/2026

CVE-2026-42944

Publication date:

20/05/2026

NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options (&#39;nsid&#39;, &#39;answer-cookie&#39;, &#39;pad-responses&#39; (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.

Severity CVSS v4.0: HIGH

Last modification:

20/05/2026

CVE-2026-42959

Publication date:

20/05/2026

NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.

Severity CVSS v4.0: HIGH

Last modification:

20/05/2026

CVE-2026-35070

Publication date:

20/05/2026

Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization of Special Elements used in a Command (&#39;Command Injection&#39;) vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

20/05/2026

CVE-2026-40622

Publication date:

20/05/2026

NLnet Labs Unbound 1.16.2 up to and including version 1.25.0 has a vulnerability of the &#39;ghost domain names&#39; family of attacks that could extend the ghost domain window by up to one cached TTL configured value. Similar to other &#39;ghost domain names&#39; attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client NS query can cause Unbound to overwrite the cached expired parent-side referral NS rrset with the child-side apex NS rrset and essentially extend the ghost domain window by up to one cached TTL configured value (&#39;cache-max-ttl&#39;). In configurations where &#39;harden-referral-path: yes&#39; is used (non-default configuration), no client NS query is required since Unbound implicitly performs that query. Unbound 1.25.1 contains a patch with a fix that does not allow extension of TTLs for (parent) NS records regardless of their trust.

Severity CVSS v4.0: MEDIUM

Last modification:

20/05/2026

CVE-2026-32792

Publication date:

20/05/2026

NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support (&#39;--enable-dnscrypt&#39;). A bad DNSCrypt query could underflow Unbound&#39;s DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of &#39;0x00&#39; bytes and does not contain the expected &#39;0x80&#39; marker. Unbound would then start reading more bytes than necessary until it finds a non-&#39;0x00&#39; byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound&#39;s later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.

Severity CVSS v4.0: MEDIUM

Last modification:

20/05/2026

CVE-2026-33278

Publication date:

20/05/2026

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-copies response messages to preserve them across memory region teardown. A struct-assignment bug overwrites the destination&#39;s pointer with the source&#39;s pointer. After the sub-query region is freed, the resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep copying the data structure.

Severity CVSS v4.0: CRITICAL

Last modification:

20/05/2026

CVE-2026-41054

Publication date:

20/05/2026

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.

Severity CVSS v4.0: Pending analysis

Last modification:

22/05/2026

CVE-2026-9059

Publication date:

20/05/2026

NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the &#39;orderby&#39; parameter on the REST API endpoints &#39;/imagely/v1/galleries&#39; and &#39;/imagely/v1/albums&#39;. The root cause is an insufficient sanitization function (&#39;_clean_column()&#39;) in the data mapper layer that uses a character blacklist instead of a whitelist approach. This allows an authenticated attacker with the &#39;NextGEN Gallery overview&#39; capability (assigned to the Administrator role by default) to inject arbitrary SQL into the &#39;ORDER BY&#39; clause.

Severity CVSS v4.0: CRITICAL

Last modification:

20/05/2026

CVE-2026-9065

Publication date:

20/05/2026

SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters (&#39;model_name&#39;, &#39;model_id&#39;, &#39;integration_id&#39;, &#39;provider&#39;) on the REST API endpoint &#39;/surecart/v1/integrations/{id}&#39;. The root cause is a flawed escaping bypass in the query builder (&#39;wp-query-builder&#39;). Values passed to the &#39;where()&#39; method are only sanitized via &#39;$wpdb->prepare()&#39; when they do **not** contain a dot (&#39;.&#39;) or the WordPress table prefix (&#39;wp_&#39;). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the &#39;WHERE&#39; clause, allowing full UNION-based extraction of the database.

Severity CVSS v4.0: CRITICAL

Last modification:

20/05/2026

Subscribe to Vulnerabilities