Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-42170

Publication date:
08/08/2026
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2026

CVE-2026-67620

Publication date:
08/08/2026
Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.
Severity CVSS v4.0: MEDIUM
Last modification:
08/08/2026

CVE-2026-19288

Publication date:
08/08/2026
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to path traversal. The attack needs to be performed locally. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
08/08/2026

CVE-2026-19287

Publication date:
08/08/2026
A flaw has been found in abrinsmead mindpilot-mcp 0.5.0. Affected by this issue is some unknown functionality of the component HistoryService. This manipulation of the argument ID causes path traversal. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
08/08/2026

CVE-2026-19282

Publication date:
08/08/2026
A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bdc8a6d0. This impacts the function auto.capture of the file src/autolearn/GitHooksManager.ts of the component llm_memory_mcp. Executing a manipulation of the argument hash can lead to command injection. The attack is restricted to local execution. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
08/08/2026

CVE-2026-19284

Publication date:
08/08/2026
A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
08/08/2026

CVE-2026-19285

Publication date:
08/08/2026
A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c. Affected by this vulnerability is the function JsonMemoryStorage.createDomain/JsonMemoryStorage.getMemories/JsonMemoryStorage.saveMemories of the file src/tools/memoryTools.ts. The manipulation results in path traversal. The attack must be initiated from a local position. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
08/08/2026

CVE-2026-19281

Publication date:
08/08/2026
A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
08/08/2026

CVE-2026-19279

Publication date:
08/08/2026
A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.
Severity CVSS v4.0: LOW
Last modification:
08/08/2026

CVE-2026-68082

Publication date:
08/08/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> libceph: fix two unsafe bare decodes in decode_lockers()<br /> <br /> decode_lockers() in cls_lock_client.c contains two bare decode operations<br /> that allow a malicious or compromised OSD to trigger slab-out-of-bounds<br /> reads:<br /> <br /> 1. ceph_decode_32(p) at the num_lockers field has no preceding bounds<br /> check. ceph_start_decoding() accepts struct_len=0 as valid -- the<br /> internal ceph_decode_need(p, end, 0, bad) always passes -- so when an<br /> OSD sends struct_len=0, ceph_start_decoding() returns success with<br /> p == end. The immediately following bare ceph_decode_32(p) then reads<br /> 4 bytes past the validated buffer boundary. The garbage value is<br /> passed directly to kzalloc_objs() as the locker count.<br /> <br /> The sibling function decode_watchers() in osd_client.c already uses<br /> ceph_decode_32_safe() after its own ceph_start_decoding() call.<br /> decode_lockers() was the only site using the bare variant.<br /> <br /> 2. ceph_decode_8(p) after the decode_locker() loop has no preceding<br /> bounds check. If an OSD crafts num_lockers such that the loop<br /> advances p exactly to end, the subsequent bare ceph_decode_8(p) reads<br /> one byte past the validated buffer boundary. The result is passed<br /> directly into *type, which is used as a lock type discriminator by<br /> callers, giving an OSD-controlled one-byte OOB read with direct<br /> influence over the lock type field.<br /> <br /> Fix both by replacing bare operations with their safe variants:<br /> ceph_decode_32(p) -&gt; ceph_decode_32_safe(p, end, *num_lockers,<br /> err_inval)<br /> ceph_decode_8(p) -&gt; ceph_decode_8_safe(p, end, *type,<br /> err_free_lockers)<br /> <br /> The goto targets differ intentionally:<br /> err_inval: is a new label returning -EINVAL directly. It is used for<br /> the pre-allocation failure path where *lockers is not yet allocated<br /> and must not be passed to ceph_free_lockers().<br /> <br /> err_free_lockers: is the existing label. It is used for the<br /> post-allocation failure path where *lockers is allocated and must<br /> be freed.<br /> <br /> ret is set to -EINVAL before ceph_decode_8_safe() so that<br /> err_free_lockers returns the correct error code on bounds violation.<br /> Without this, err_free_lockers would return a stale ret value (0 from<br /> the successful decode_locker() loop), silently swallowing the error.<br /> <br /> -EINVAL is correct for both failure paths. The data received from the<br /> OSD is structurally malformed. -ENOMEM would misrepresent the failure<br /> class to callers and to stable@ backporters triaging error paths.<br /> <br /> Attacker model: a malicious or compromised OSD in a multi-tenant Ceph<br /> deployment can trigger this against any kernel client that issues the<br /> lock.get_info class method (e.g. during RBD exclusive lock acquisition).<br /> <br /> [ idryomov: trim changelog, formatting ]
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2026

CVE-2026-68081

Publication date:
08/08/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state<br /> <br /> Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid<br /> guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path<br /> doesn&amp;#39;t use nested_vmx_vmexit() as that API is intended to be used if and<br /> only if L2 is active, and the open coded equivalent neglects to put the<br /> vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages<br /> (and/or mappings) if L1 retries VMLAUNCH/VMRESUME.<br /> <br /> Note, the !from_vmenter scenario doesn&amp;#39;t suffer the same problem, as<br /> vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is<br /> active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry<br /> getting vmcs12 pages.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2026

CVE-2026-19266

Publication date:
08/08/2026
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1 mitigates this issue. This patch is called e0729dcfd3a2b1682a7bff86e7174852c03419ba. It is advisable to upgrade the affected component.
Severity CVSS v4.0: MEDIUM
Last modification:
08/08/2026