Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-54800
Publication date:
09/07/2026
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions
Severity CVSS v4.0: MEDIUM
Last modification:
09/07/2026

CVE-2026-54801
Publication date:
09/07/2026
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions
Severity CVSS v4.0: HIGH
Last modification:
09/07/2026

CVE-2026-60094
Publication date:
09/07/2026
Vinchin Backup & Recovery through 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB and resulting in process crash or potential memory corruption.
Severity CVSS v4.0: MEDIUM
Last modification:
10/07/2026

CVE-2026-60095
Publication date:
09/07/2026
Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.
Severity CVSS v4.0: MEDIUM
Last modification:
10/07/2026

CVE-2026-4256
Publication date:
09/07/2026
Improper neutralization of special elements used in an LDAP query (&amp;#39;LDAP injection&amp;#39;) vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection.<br /> <br /> This issue affects PassGate: through 30042026.
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2026

CVE-2026-15186
Publication date:
09/07/2026
A vulnerability was identified in macrozheng mall up to 1.0.3. This impacts an unknown function of the file /returnApply/create of the component Portal Endpoint. The manipulation of the argument orderId leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor deleted the GitHub issue for this vulnerability without any explanation.
Severity CVSS v4.0: LOW
Last modification:
09/07/2026

CVE-2026-15185
Publication date:
09/07/2026
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
Severity CVSS v4.0: LOW
Last modification:
09/07/2026

CVE-2026-14261
Publication date:
09/07/2026
A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2026

CVE-2026-12879
Publication date:
09/07/2026
An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data.<br /> <br /> <br /> This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.
Severity CVSS v4.0: MEDIUM
Last modification:
09/07/2026

CVE-2026-12116
Publication date:
09/07/2026
A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path in the tools server settings, which can be changed to a PHP interpreter, allowing an attacker to upload PHP data that will then be executed.
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2026

CVE-2026-12593
Publication date:
09/07/2026
The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an API Token for another user had sufficient permission to do so.<br /> <br /> <br /> <br /> <br /> <br /> Precondition for successful exploitation was a preexisting internal user (with more privileges than the attacker), the attacker knowing its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker would then have had to forge a token creation API request on behalf of the other user and could have authenticated and finalized the token creation with their own OAuth/OIDC credentials. In the worst case, this would mean an attacker could have become Dashboard Administrator and been able to perform all administrative actions if the preexisting internal user had administrative privileges. In combination with a separate weakness, this could have further led to code execution on the host system running the Dashboard with the privileges of the OS-User running the Dashboard server.
Severity CVSS v4.0: HIGH
Last modification:
10/07/2026

CVE-2026-15184
Publication date:
09/07/2026
A vulnerability was found in GNU LibreDWG up to 0.13.4. The impacted element is the function dwg_next_entity of the file src/dwg.c of the component DWG File Handler. Performing a manipulation of the argument next_obj results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used. Upgrading to version 0.14 is sufficient to resolve this issue. The patch is named dde45dac3c4d902e4d8fed150a8017b9732019c9. Upgrading the affected component is recommended. Different than CVE-2026-9503.
Severity CVSS v4.0: LOW
Last modification:
09/07/2026
Subscribe to Vulnerabilities