Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-42162

Publication date:
17/08/2026
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-42164

Publication date:
17/08/2026
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-67919

Publication date:
17/08/2026
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-67961

Publication date:
17/08/2026
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution.
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-75078

Publication date:
17/08/2026
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
Severity CVSS v4.0: LOW
Last modification:
17/08/2026

CVE-2026-75587

Publication date:
17/08/2026
Mattermost Desktop App versions
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-9693

Publication date:
17/08/2026
Mattermost versions 10.11.x
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-38165

Publication date:
17/08/2026
A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression.
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-9816

Publication date:
17/08/2026
Mattermost versions 11.7.x
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-9859

Publication date:
17/08/2026
Mattermost versions 11.7.x
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-67960

Publication date:
17/08/2026
An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026

CVE-2026-69146

Publication date:
17/08/2026
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.
Severity CVSS v4.0: Pending analysis
Last modification:
17/08/2026