Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-50631

Publication date:

12/06/2026

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when &#39;recycleRefreshTokens&#39; is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50632

Publication date:

12/06/2026

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50633

Publication date:

12/06/2026

A JNDI Injection vulnerability has been discovered in Apache CXF&#39;s JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50634

Publication date:

12/06/2026

A vulnerability in Apache CXF&#39;s JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated by the accepted signature. This can bypass the application&#39;s assumption that accepted `Content-Type` or protected HTTP-header metadata came from a verified signature entry, and may steer downstream JAX-RS entity parsing or signed-header consistency checks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50645

Publication date:

12/06/2026

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-48914

Publication date:

12/06/2026

A flaw was found in QEMU&#39;s virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-49875

Publication date:

12/06/2026

Apache CXF&#39;s EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50623

Publication date:

12/06/2026

An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing &#39;throw&#39; keyword in the security context check, the introspection endpoint (/services/oauth2/introspect) can be accessed by any unauthenticated network attacker. However note that this is a safeguard only in the case that someone forgot to enable authentication on the service. Users are recommended to upgrade to version 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50627

Publication date:

12/06/2026

The JwtAccessTokenValidator class in Apache CXF fails to validate the &#39;aud&#39; (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50628

Publication date:

12/06/2026

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50629

Publication date:

12/06/2026

The &#39;clientId&#39; parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server&#39;s log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

CVE-2026-50630

Publication date:

12/06/2026

A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the &#39;realm&#39; parameter is concatenated without sanitizing Carriage Return (CR) and Line Feed (LF) characters. If an attacker can control the realm value, they can inject arbitrary HTTP headers or split the HTTP response entirely. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2026

Subscribe to Vulnerabilities