Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-32763

Publication date:

20/03/2026

Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The `visitJSONPathLeg()` function appends user-controlled values from `.key()` and `.at()` directly into single-quoted JSON path string literals (`&#39;$.key&#39;`) without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL. This is inconsistent with `sanitizeIdentifier()`, which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected. Version 0.28.12 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-32764

Publication date:

20/03/2026

Rejected reason: This repository is no longer public.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-29109

Publication date:

20/03/2026

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions up to and including 8.9.2 contain an unsafe deserialization vulnerability in the SavedSearch filter processing component that allows an authenticated administrator to execute arbitrary system commands on the server. `FilterDefinitionProvider.php` calls `unserialize()` on user-controlled data from the `saved_search.contents` database column without restricting instantiable classes. Version 8.9.3 patches the issue.

Severity CVSS v4.0: HIGH

Last modification:

20/03/2026

CVE-2026-29189

Publication date:

20/03/2026

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST API V8 has missing ACL (Access Control List) checks on several endpoints, allowing authenticated users to access and manipulate data they should not have permission to interact with. Versions 7.15.1 and 8.9.3 patch the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-32697

Publication date:

20/03/2026

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `RecordHandler::getRecord()` method retrieves any record by module and ID without checking the current user&#39;s ACL view permission. The companion `saveRecord()` method correctly checks `$bean->ACLAccess(&#39;save&#39;)`, but `getRecord()` skips the equivalent `ACLAccess(&#39;view&#39;)` check. Version 8.9.3 patches the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-32756

Publication date:

20/03/2026

Admidio is an open-source user management solution. Versions 5.0.6 and below contain a critical unrestricted file upload vulnerability in the Documents & Files module. Due to a design flaw in how CSRF token validation and file extension verification interact within UploadHandlerFile.php, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution on the server, resulting in full server compromise, data exfiltration, and lateral movement. This issue has been fixed in version 5.0.7.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-32757

Publication date:

20/03/2026

Admidio is an open-source user management solution. In versions 5.0.6 and below, the eCard send handler uses a raw $_POST[&#39;ecard_message&#39;] value instead of the HTMLPurifier-sanitized $formValues[&#39;ecard_message&#39;] when constructing the greeting card HTML. This allows an authenticated attacker to inject arbitrary HTML and JavaScript into greeting card emails sent to other members, bypassing the server-side HTMLPurifier sanitization that is properly applied to the ecard_message field during form validation. An attack can result in any member or role receiving phishing content that appears legitimate, crossing from the web application into recipients&#39; email clients. This issue has been fixed in version 5.0.7.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-22733

Publication date:

20/03/2026

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-22735

Publication date:

20/03/2026

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-22737

Publication date:

20/03/2026

Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026

CVE-2026-29108

Publication date:

20/03/2026

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, an authenticated API endpoint allows any user to retrieve detailed information about any other user, including their password hash, username, and MFA configuration. As any authenticated user can query this endpoint, it&#39;s possible to retrieve and potentially crack the passwords of administrative users. Version 8.9.3 patches the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

20/03/2026