Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-41332

Publication date:

23/04/2026

OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT_TEMPLATE_DIR and AWS_CONFIG_FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration files to execute untrusted code or load malicious credentials.

Severity CVSS v4.0: MEDIUM

Last modification:

24/04/2026

CVE-2026-35431

Publication date:

23/04/2026

Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-41274

Publication date:

23/04/2026

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the underlying Neo4j database, enabling data exfiltration, modification, or deletion. This vulnerability is fixed in 3.1.0.

Severity CVSS v4.0: CRITICAL

Last modification:

24/04/2026

CVE-2026-33102

Publication date:

23/04/2026

Url redirection to untrusted site (&#39;open redirect&#39;) in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-33819

Publication date:

23/04/2026

Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-32210

Publication date:

23/04/2026

Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-32172

Publication date:

23/04/2026

Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-2708

Publication date:

23/04/2026

A request smuggling vulnerability exists in libsoup&#39;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-26210

Publication date:

23/04/2026

KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.

Severity CVSS v4.0: CRITICAL

Last modification:

24/04/2026

CVE-2026-26150

Publication date:

23/04/2026

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-24303

Publication date:

23/04/2026

Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-6942

Publication date:

23/04/2026

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.

Severity CVSS v4.0: CRITICAL

Last modification:

24/04/2026

Subscribe to Vulnerabilities