Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-30807

Publication date:
12/05/2026
Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800
Severity CVSS v4.0: HIGH
Last modification:
13/05/2026

CVE-2026-30805

Publication date:
12/05/2026
Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affects Pandora FMS: from 777 through 800
Severity CVSS v4.0: CRITICAL
Last modification:
13/05/2026

CVE-2023-30059

Publication date:
12/05/2026
An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request.
Severity CVSS v4.0: Pending analysis
Last modification:
13/05/2026

CVE-2023-27753

Publication date:
12/05/2026
An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file.
Severity CVSS v4.0: Pending analysis
Last modification:
13/05/2026

CVE-2026-8401

Publication date:
12/05/2026
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3.
Severity CVSS v4.0: Pending analysis
Last modification:
15/05/2026

CVE-2026-8368

Publication date:
12/05/2026
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.<br /> <br /> On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes.<br /> <br /> A redirect to an attacker controlled host therefore discloses the caller&amp;#39;s credentials to that host.
Severity CVSS v4.0: Pending analysis
Last modification:
12/05/2026

CVE-2026-8111

Publication date:
12/05/2026
SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
12/05/2026

CVE-2026-8110

Publication date:
12/05/2026
Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
12/05/2026

CVE-2026-8109

Publication date:
12/05/2026
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.
Severity CVSS v4.0: Pending analysis
Last modification:
12/05/2026

CVE-2026-7432

Publication date:
12/05/2026
A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM
Severity CVSS v4.0: Pending analysis
Last modification:
12/05/2026

CVE-2026-8043

Publication date:
12/05/2026
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks.
Severity CVSS v4.0: Pending analysis
Last modification:
13/05/2026

CVE-2026-8051

Publication date:
12/05/2026
OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
15/05/2026