Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-22768

Publication date:

01/04/2026

Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2026

CVE-2026-22767

Publication date:

01/04/2026

Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2026

CVE-2026-25601

Publication date:

01/04/2026

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user passwords before storing them in the application’s database. An attacker with sufficient privileges to access the database could extract the encrypted passwords, decrypt them using the embedded key, and gain unauthorized access to the associated ICS/OT environment.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2026-24096

Publication date:

01/04/2026

Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information

Severity CVSS v4.0: MEDIUM

Last modification:

01/04/2026

CVE-2026-0932

Publication date:

01/04/2026

Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.

Severity CVSS v4.0: MEDIUM

Last modification:

02/04/2026

CVE-2026-21631

Publication date:

01/04/2026

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Severity CVSS v4.0: MEDIUM

Last modification:

01/04/2026

CVE-2026-21632

Publication date:

01/04/2026

Lack of output escaping for article titles leads to XSS vectors in various locations.

Severity CVSS v4.0: MEDIUM

Last modification:

01/04/2026

CVE-2026-23898

Publication date:

01/04/2026

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

Severity CVSS v4.0: HIGH

Last modification:

01/04/2026

CVE-2026-23899

Publication date:

01/04/2026

An improper access check allows unauthorized access to webservice endpoints.

Severity CVSS v4.0: HIGH

Last modification:

01/04/2026

CVE-2026-1879

Publication date:

01/04/2026

A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the file /ThemeAndWidgets.xhtml of the component Theme Customization. Performing a manipulation of the argument uploadLogo results in unrestricted upload. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 6.10 mitigates this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Severity CVSS v4.0: MEDIUM

Last modification:

01/04/2026

CVE-2026-21629

Publication date:

01/04/2026

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.

Severity CVSS v4.0: MEDIUM

Last modification:

01/04/2026