Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-73250

Publication date:

11/08/2026

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory `$INSTDIR` from PowerEditor/installer/nppSetup.nsi into a PowerShell `-Command` string used by RegisterMSIX to invoke Add-AppxPackage, allowing PowerShell subexpression syntax such as `$()` in the installation path to execute commands in the installer&#39;s security context when the context menu component is selected. This issue is fixed in version 8.9.7.

Severity CVSS v4.0: MEDIUM

Last modification:

11/08/2026

CVE-2026-73245

Publication date:

11/08/2026

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra&#39;s cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels. This issue is fixed in 2.0.0-rc6.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-73246

Publication date:

11/08/2026

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra&#39;s worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-73247

Publication date:

11/08/2026

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra&#39;s core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-73248

Publication date:

11/08/2026

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

Severity CVSS v4.0: HIGH

Last modification:

11/08/2026

CVE-2026-73249

Publication date:

11/08/2026

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

Severity CVSS v4.0: Pending analysis

Last modification:

11/08/2026

CVE-2026-68067

Publication date:

11/08/2026

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

Severity CVSS v4.0: CRITICAL

Last modification:

11/08/2026

CVE-2026-66875

Publication date:

11/08/2026

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.

Severity CVSS v4.0: HIGH

Last modification:

11/08/2026

CVE-2026-67558

Publication date:

11/08/2026

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim&#39;s cloud record and clinical trend view.

Severity CVSS v4.0: HIGH

Last modification:

11/08/2026

CVE-2026-67568

Publication date:

11/08/2026

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

Severity CVSS v4.0: CRITICAL

Last modification:

11/08/2026

CVE-2026-66340

Publication date:

11/08/2026

The Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts.

Severity CVSS v4.0: MEDIUM

Last modification:

11/08/2026

CVE-2026-66098

Publication date:

11/08/2026

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow.

Severity CVSS v4.0: HIGH

Last modification:

11/08/2026

Subscribe to Vulnerabilities