Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-32210

Publication date:

23/04/2026

Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-32172

Publication date:

23/04/2026

Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-2708

Publication date:

23/04/2026

A request smuggling vulnerability exists in libsoup&#39;s HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-26210

Publication date:

23/04/2026

KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads() without validation. Attackers can send a crafted pickle payload to the exposed ZMQ socket to execute arbitrary code on the server with the privileges of the ktransformers process.

Severity CVSS v4.0: CRITICAL

Last modification:

24/04/2026

CVE-2026-26150

Publication date:

23/04/2026

Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-24303

Publication date:

23/04/2026

Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2026

CVE-2026-6375

Publication date:

23/04/2026

A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.

Severity CVSS v4.0: HIGH

Last modification:

24/04/2026

CVE-2026-6376

Publication date:

23/04/2026

A weakness in SpiceJet’s public booking retrieval page permits full passenger booking details to be accessed using only a PNR and last name, with no authentication or verification mechanisms. This results in exposure of extensive personal, travel, and booking metadata to any unauthenticated user who can obtain or guess those basic inputs. The issue arises from improper access control on a sensitive data retrieval function.

Severity CVSS v4.0: HIGH

Last modification:

24/04/2026

CVE-2026-6940

Publication date:

23/04/2026

radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local attackers to recursively delete arbitrary directories by supplying absolute paths that escape the configured dir.projects root directory. Attackers can craft absolute paths to project marker files outside the project storage boundary to cause recursive deletion of attacker-chosen directories with permissions of the radare2 process, resulting in integrity and availability loss.

Severity CVSS v4.0: MEDIUM

Last modification:

24/04/2026

CVE-2026-6941

Publication date:

23/04/2026

radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that allows attackers to read or write files outside the configured project directory by importing a malicious .zrp archive containing a symlinked notes.txt file. Attackers can craft a .zrp archive with a symlinked notes.txt that bypasses directory confinement checks, allowing note operations to follow the symlink and access arbitrary files outside the dir.projects root directory.

Severity CVSS v4.0: MEDIUM

Last modification:

24/04/2026

CVE-2026-6942

Publication date:

23/04/2026

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.

Severity CVSS v4.0: CRITICAL

Last modification:

24/04/2026

CVE-2026-28525

Publication date:

23/04/2026

SWUpdate contains an integer underflow vulnerability in the multipart upload parser in mongoose_multipart.c that allows unauthenticated attackers to cause a denial of service by sending a crafted HTTP POST request to /upload with a malformed multipart boundary and controlled TCP stream timing. Attackers can trigger an integer underflow in the mg_http_multipart_continue_wait_for_chunk() function when the buffer length falls within a specific range, causing an out-of-bounds heap read that writes data beyond the allocated receive buffer to a local IPC socket.

Severity CVSS v4.0: HIGH

Last modification:

24/04/2026

Subscribe to Vulnerabilities