Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-25813

Publication date:

09/02/2026

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.

Severity CVSS v4.0: HIGH

Last modification:

09/02/2026

CVE-2025-15315

Publication date:

09/02/2026

Tanium addressed a local privilege escalation vulnerability in Tanium Module Server.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2026

CVE-2025-15316

Publication date:

09/02/2026

Tanium addressed a local privilege escalation vulnerability in Tanium Server.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2026

CVE-2025-15317

Publication date:

09/02/2026

Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2026

CVE-2026-25810

Publication date:

09/02/2026

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/student.submission.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks).

Severity CVSS v4.0: MEDIUM

Last modification:

09/02/2026

CVE-2026-25876

Publication date:

09/02/2026

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the backend/src/routes/results.routes.ts verify authentication but fails to enforce object-level authorization (ownership checks). For example, this can be used to return all results for an assessment.

Severity CVSS v4.0: MEDIUM

Last modification:

09/02/2026

CVE-2026-25878

Publication date:

09/02/2026

FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.

Severity CVSS v4.0: MEDIUM

Last modification:

09/02/2026

CVE-2026-25639

Publication date:

09/02/2026

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in 1.13.5.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2026

CVE-2026-25740

Publication date:

09/02/2026

captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and earlier, when programs.captive-browser is enabled, any user of the system can run arbitrary commands with the CAP_NET_RAW capability (binding to privileged ports, spoofing localhost traffic from privileged services...). This vulnerability is fixed in 25.11 and 26.05.

Severity CVSS v4.0: MEDIUM

Last modification:

09/02/2026

CVE-2026-25761

Publication date:

09/02/2026

Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull request that introduces a file whose name contains shell command substitution syntax, such as $(...). In affected Super-linter versions, runtime scripts may execute the embedded command during file discovery processing, enabling arbitrary command execution in the workflow runner context. This can be used to disclose the job’s GITHUB_TOKEN depending on how the workflow configures permissions. This vulnerability is fixed in 8.3.1.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2026

CVE-2026-25765

Publication date:

09/02/2026

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday&#39;s build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby&#39;s URI#merge to combine the connection&#39;s base URL with a user-supplied path. Per RFC 3986, protocol-relative URLs (e.g. //evil.com/path) are treated as network-path references that override the base URL&#39;s host/authority component. This means that if any application passes user-controlled input to Faraday&#39;s get(), post(), build_url(), or other request methods, an attacker can supply a protocol-relative URL like //attacker.com/endpoint to redirect the request to an arbitrary host, enabling Server-Side Request Forgery (SSRF). This vulnerability is fixed in 2.14.1.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2026

CVE-2026-25791

Publication date:

09/02/2026

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2026

Subscribe to Vulnerabilities