Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-43821
Publication date:
27/07/2026
An access issue was addressed with improved access restrictions. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to read files outside of its sandbox.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-43822
Publication date:
27/07/2026
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-59728
Publication date:
27/07/2026
Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing " can break out of an attribute (as with enclosure.type), and a value containing can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-59730
Publication date:
27/07/2026
Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host. Preconditions for exploitation: trailingSlash: 'always' must be set (non-default; the default is 'ignore'), the request path must not have a file extension in its final segment, and an attacker must deliver the crafted link to a user. This issue has been fixed in version 11.0.2.
Severity CVSS v4.0: LOW
Last modification:
27/07/2026

CVE-2026-64537
Publication date:
27/07/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bridge: cfm: reject invalid CCM interval at configuration time<br /> <br /> ccm_tx_work_expired() re-arms itself via queue_delayed_work() using<br /> the configured exp_interval converted by interval_to_us(). When<br /> exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range,<br /> interval_to_us() returns 0, causing the worker to fire immediately in<br /> a tight loop that allocates skbs until OOM.<br /> <br /> Fix this by validating exp_interval at configuration time:<br /> <br /> - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range<br /> [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the<br /> netlink policy so userspace cannot set an invalid value.<br /> <br /> - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has<br /> not yet been configured (defaults to 0 from kzalloc).
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-43809
Publication date:
27/07/2026
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-43810
Publication date:
27/07/2026
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-43811
Publication date:
27/07/2026
A race condition was addressed with improved checks. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to modify protected parts of the file system.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-43812
Publication date:
27/07/2026
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6. An app may be able to cause unexpected system termination.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-43813
Publication date:
27/07/2026
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-43814
Publication date:
27/07/2026
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026

CVE-2026-43816
Publication date:
27/07/2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
Severity CVSS v4.0: Pending analysis
Last modification:
27/07/2026
Subscribe to Vulnerabilities