Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-32682
Publication date:
17/06/2026
When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with permission to create or modify GRPCRoute resources can cause the NGINX Gateway Fabric control plane to terminate by sending undisclosed GRPCRoute configurations containing backendRef filters. <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
02/07/2026

CVE-2026-11407
Publication date:
17/06/2026
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the custom Twig SecurityPolicy. Attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\Text component to perform arbitrary file reads, execute arbitrary database queries, and potentially achieve remote code execution via PHP object gadget chains, with the pimcore_* function wildcard further broadening the bypass to all Pimcore Twig functions.
Severity CVSS v4.0: HIGH
Last modification:
23/06/2026

CVE-2026-10741
Publication date:
17/06/2026
Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy repository configuration that allows a delegated repository administrator to disclose stored upstream proxy credentials.
Severity CVSS v4.0: MEDIUM
Last modification:
21/07/2026

CVE-2026-10696
Publication date:
17/06/2026
Use of an incorrectly resolved name or reference in the pinget backend <br /> in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community <br /> catalog contributor to cause an installed application to be correlated <br /> to an unrelated, attacker-controlled catalog package and to execute an <br /> attacker-controlled installer via a crafted catalog package whose <br /> normalized name is contained as a substring within the installed <br /> application name when a user applies the proposed update.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2026

CVE-2026-55196
Publication date:
17/06/2026
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers to claim the first passkey and gain permanent administrative control.
Severity CVSS v4.0: CRITICAL
Last modification:
23/06/2026

CVE-2026-48818
Publication date:
17/06/2026
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.
Severity CVSS v4.0: Pending analysis
Last modification:
15/07/2026

CVE-2026-9697
Publication date:
17/06/2026
Impact:<br /> undici&amp;#39;s ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or socks://). The target HTTPS connection through the SOCKS5 tunnel falls back to Node&amp;#39;s default trust store, ignoring user-configured ca, cert, key, rejectUnauthorized, and servername settings.<br /> <br /> Applications that pin to an internal or corporate CA via requestTls.ca will, when their proxy URI is SOCKS5, get the default Mozilla CA bundle as the trust anchor instead. Any cert signed by any publicly-trusted CA for the target hostname is accepted, breaking the intended pin and enabling MITM read and tamper of the HTTPS exchange.<br /> <br /> Affected applications are those that use undici&amp;#39;s ProxyAgent (or Socks5ProxyAgent directly) with SOCKS5 AND rely on requestTls for TLS scope restriction. The bug was introduced in undici 7.23.0 when SOCKS5 support was added.<br /> <br /> Patches:<br /> Upgrade to undici v7.28.0 or v8.5.0.<br /> <br /> Workarounds:<br /> No workaround is available within the SOCKS5 path. If a SOCKS5 proxy with TLS scope restriction is required and an upgrade is not yet possible, route the traffic through an HTTP-proxy ProxyAgent instead, where requestTls is honored correctly.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-6733
Publication date:
17/06/2026
Impact:<br /> Undici&amp;#39;s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.<br /> <br /> This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.<br /> <br /> Patches:<br /> Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.<br /> <br /> Workarounds:<br /> Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.
Severity CVSS v4.0: Pending analysis
Last modification:
27/06/2026

CVE-2026-7300
Publication date:
17/06/2026
Buffer Copy without Checking Size of Input (&amp;#39;Classic Buffer Overflow&amp;#39;) vulnerability in RTI Connext Professional (Web Integration Service) allows Filter Failure through Buffer Overflow.This issue affects Connext Professional: from 7.4.0 before 7.*, from 7.0.0 before 7.3.1.3, from 6.1.2 before 6.1.*.
Severity CVSS v4.0: HIGH
Last modification:
08/07/2026

CVE-2026-53805
Publication date:
17/06/2026
NVIDIA Spatial Intelligence Lab&amp;#39;s (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python&amp;#39;s pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process.
Severity CVSS v4.0: CRITICAL
Last modification:
14/07/2026

CVE-2026-6734
Publication date:
17/06/2026
Impact:<br /> When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying that the pool&amp;#39;s origin matches the requested origin. All requests are dispatched through the pool connected to the first origin, regardless of the intended destination.<br /> <br /> This causes cross-origin request routing: credentials and request data intended for origin B are sent to origin A, responses from the wrong origin are trusted, and HTTPS requests may be silently downgraded to HTTP.<br /> <br /> Impacted users are applications that use Socks5ProxyAgent (directly or via setGlobalDispatcher) and make requests to more than one origin.<br /> <br /> This was introduced in undici 7.23.0 via PR #4385 and affects all versions through 8.1.0.<br /> <br /> Patches:<br /> Upgrade to undici v7.26.0 or v8.2.0.<br /> <br /> Workarounds:<br /> Use a separate Socks5ProxyAgent instance per origin, or avoid using Socks5ProxyAgent with multiple origins.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2026

CVE-2026-48591
Publication date:
17/06/2026
Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values.<br /> <br /> &amp;#39;Elixir.Earmark.Transform&amp;#39;:_make_att1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: [" ", name, "=\"", value, "\""]. Text nodes are routed through the existing escape function which encodes " as &amp;quot;, but attribute values never visit that path. A markdown link whose URL or title contains a bare " closes the attribute early and lets the trailing bytes be parsed by the browser as fresh HTML attributes. For example, [click](http://example.com/?a=x" onerror="alert(1)) renders as click, executing arbitrary JavaScript in the victim&amp;#39;s browser.<br /> <br /> The earmark library is no longer maintained and has been retired on Hex. No patched version will be released. All releases from 1.4.1 onward are affected, and users should migrate to a maintained Markdown library such as MDEx.<br /> <br /> This issue affects earmark from 1.4.1 onward.
Severity CVSS v4.0: MEDIUM
Last modification:
22/06/2026
Subscribe to Vulnerabilities