Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-58554

Publication date:

15/07/2026

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-58550

Publication date:

15/07/2026

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-58551

Publication date:

15/07/2026

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-58552

Publication date:

15/07/2026

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-58549

Publication date:

15/07/2026

Out-of-bounds read vulnerability in the image codec module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-46459

Publication date:

15/07/2026

ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database.<br /> This issue has been fixed in version 2.4.18.029

Severity CVSS v4.0: MEDIUM

Last modification:

15/07/2026

CVE-2026-46458

Publication date:

15/07/2026

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot.<br /> This issue has been fixed in version 2.4.18.029

Severity CVSS v4.0: HIGH

Last modification:

15/07/2026

CVE-2026-15779

Publication date:

15/07/2026

A flaw was found in samba&#39;s pam_winbind. When mkhomedir is enabled, pam_winbind chowns the target account&#39;s home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory (a common default for system accounts) can have this triggered not only by root, but by a non-root user holding a narrow sudo delegation to run commands as that account, causing ownership of / to change and resulting in severe denial of service (SSH, sudo, and package-manager failures). The change does not grant write access to / (which ships with restrictive 0555 permissions on RHEL), so the impact is availability loss rather than further privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

15/07/2026

CVE-2026-15809

Publication date:

15/07/2026

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

Severity CVSS v4.0: Pending analysis

Last modification:

16/07/2026

CVE-2026-61871

Publication date:

15/07/2026

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.

Severity CVSS v4.0: MEDIUM

Last modification:

15/07/2026

CVE-2026-61872

Publication date:

15/07/2026

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.

Severity CVSS v4.0: LOW

Last modification:

15/07/2026

CVE-2026-61869

Publication date:

15/07/2026

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.

Severity CVSS v4.0: LOW

Last modification:

15/07/2026

Subscribe to Vulnerabilities