Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-33479

Publication date:

23/03/2026

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin&#39;s `saveSort.json.php` endpoint passes unsanitized user input from `$_REQUEST[&#39;sections&#39;]` array values directly into PHP&#39;s `eval()` function. While the endpoint is gated behind `User::isAdmin()`, it has no CSRF token validation. Combined with AVideo&#39;s explicit `SameSite=None` session cookie configuration, an attacker can exploit this via cross-site request forgery to achieve unauthenticated remote code execution — requiring only that an admin visits an attacker-controlled page. Commit 087dab8841f8bdb54be184105ef19b47c5698fcb contains a patch.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2026

CVE-2026-33478

Publication date:

23/03/2026

WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo&#39;s CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.json.php` endpoint exposes clone secret keys without authentication, which can be used to trigger a full database dump via `cloneServer.json.php`. The dump contains admin password hashes stored as MD5, which are trivially crackable. With admin access, the attacker exploits an OS command injection in the rsync command construction in `cloneClient.json.php` to execute arbitrary system commands. Commit c85d076375fab095a14170df7ddb27058134d38c contains a patch.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2026

CVE-2026-33354

Publication date:

23/03/2026

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.php` accepts a requester-controlled `chunkFile` parameter intended for staged upload chunks. Instead of restricting that path to trusted server-generated chunk locations, the endpoint accepts arbitrary local filesystem paths that pass `isValidURLOrPath()`. That helper allows files under broad server directories including `/var/www/`, the application root, cache, tmp, and `videos`, only rejecting `.php` files. For an authenticated uploader editing their own video, this becomes an arbitrary local file read. The endpoint copies the attacker-chosen local file into the attacker&#39;s public video storage path, after which it can be downloaded over HTTP. Commit 59bbd601a3f65a5b18c1d9e4eb11471c0a59214f contains a patch for the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2026

CVE-2026-4645

Publication date:

23/03/2026

Rejected reason: Duplicate of CVE-2026-32287

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2026

CVE-2026-4647

Publication date:

23/03/2026

A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files and executables. The issue occurs when processing specially crafted XCOFF object files, where a relocation type value is not properly validated before being used. This can cause the program to read memory outside of intended bounds. As a result, affected tools may crash or expose unintended memory contents, leading to denial-of-service or limited information disclosure risks.

Severity CVSS v4.0: Pending analysis

Last modification:

24/03/2026

CVE-2026-4589

Publication date:

23/03/2026

A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/explorer/editor.class.php of the component fileGet Endpoint. Such manipulation of the argument path leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2026-3635

Publication date:

23/03/2026

Summary<br /> When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: &#39;10.0.0.1&#39;, a subnet, a hop count, or a custom function), the request.protocol and request.host getters read X-Forwarded-Proto and X-Forwarded-Host headers from any connection — including connections from untrusted IPs. This allows an attacker connecting directly to Fastify (bypassing the proxy) to spoof both the protocol and host seen by the application.<br /> <br /> Affected Versions<br /> fastify

Severity CVSS v4.0: Pending analysis

Last modification:

23/03/2026

CVE-2026-33297

Publication date:

23/03/2026

WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control. Version 26.0 contains a patch for the issue.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2026-33351

Publication date:

23/03/2026

WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/saveDVR.json.php`. When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the `$_REQUEST[&#39;webSiteRootURL&#39;]` parameter is used directly to construct a URL that is fetched server-side via `file_get_contents()`. No authentication, origin validation, or URL allowlisting is performed. Version 26.0 contains a patch for the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

23/03/2026

CVE-2026-33352

Publication date:

23/03/2026

WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `getAllCategories()` method. The `doNotShowCats` request parameter is sanitized only by stripping single-quote characters (`str_replace("&#39;", &#39;&#39;, ...)`), but this is trivially bypassed using a backslash escape technique to shift SQL string boundaries. The parameter is not covered by any of the application&#39;s global input filters in `objects/security.php`. Version 26.0 contains a patch for the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

23/03/2026

CVE-2025-41008

Publication date:

23/03/2026

SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the &#39;client&#39; parameter in the &#39;/_adm/scripts/modalReport_data.php&#39; endpoint.

Severity CVSS v4.0: CRITICAL

Last modification:

23/03/2026

CVE-2019-25625

Publication date:

23/03/2026

Blob Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the key entry mechanism. Attackers can create a text file with a large buffer of repeated characters and trigger the application to read it, causing the application to crash or become unresponsive.

Severity CVSS v4.0: MEDIUM

Last modification:

24/03/2026

Subscribe to Vulnerabilities