Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-46710
Publication date:
26/06/2026
Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setting the working directory to the installation contextMenu directory. If an attacker can pre-place a malicious powershell.exe in a user-writable custom installation directory, and a privileged user later runs the installer and selects that directory, the attacker-controlled executable is launched with the elevated privileges of the installer. This vulnerability is fixed in 8.9.6.
Severity CVSS v4.0: HIGH
Last modification:
29/06/2026

CVE-2026-38639
Publication date:
26/06/2026
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of Service (DoS) via parsing a crafted input.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-38641
Publication date:
26/06/2026
An issue in the DSO::mmap_and_copy function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via loading a crafted shared library.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-39031
Publication date:
26/06/2026
Lansweeper lsrunase 2.0 and lsencrypt 2.0 use RC4 encryption with a hardcoded 142-byte static key array to encrypt credentials. An 8-character prefix is stored in cleartext alongside the ciphertext. This allows an attacker with local access to recover any encrypted password to plaintext using a single SHA-1 hash and RC4 decryption operation, with no brute force required.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-46604
Publication date:
26/06/2026
The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.
Severity CVSS v4.0: Pending analysis
Last modification:
01/07/2026

CVE-2024-23581
Publication date:
26/06/2026
The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious software or an unrecognized application.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-55188
Publication date:
26/06/2026
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket. Because the returned BucketTarget objects include remote target credentials, this can disclose replication access keys and secret keys. This vulnerability is fixed in 1.0.0-beta.9.
Severity CVSS v4.0: Pending analysis
Last modification:
27/06/2026

CVE-2026-55838
Publication date:
26/06/2026
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin handler in the codebase calls validate_admin_request to enforce admin-action IAM checks; the MetricsHandler skips this call entirely. A restricted IAM user whose policy grants only access to their own bucket can read server-wide operational metrics including disk I/O statistics, network throughput, scanner cycle timing, and cluster RPC state.
Severity CVSS v4.0: Pending analysis
Last modification:
27/06/2026

CVE-2026-55189
Publication date:
26/06/2026
RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM authorization function that the FTP write/list handlers (and the entire HTTP S3 path) use. As a result, any user who can authenticate to the FTP listener — including a user whose IAM policy contains an explicit Deny on s3:GetObject — can read (RETR) and stat (SIZE/MDTM) any object in any bucket, and probe any bucket (CWD), completely regardless of their IAM policy. This vulnerability is fixed in 1.0.0-beta.9.
Severity CVSS v4.0: Pending analysis
Last modification:
29/06/2026

CVE-2026-53317
Publication date:
26/06/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mt76: mt7921: Place upper limit on station AID<br /> <br /> Any station configured with an AID over 20 causes a firmware crash.<br /> This situation occurred in our testing using an AP interface on 7922<br /> hardware, with a modified hostapd, sourced from Mediatek&amp;#39;s OpenWRT<br /> feeds.<br /> <br /> In stock hostapd, station AIDs begin counting at 1, and this<br /> configuration is prevented with an upper limit on associated stations.<br /> However, the modified hostapd began allocation at 65, which caused the<br /> firmware to crash. This fix does not allow these AIDs to work, but will<br /> prevent the firmware crash.<br /> <br /> This crash was only seen on IFTYPE_AP interfaces, and the fix does not<br /> appear to have an effect on IFTYPE_STATION behavior.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2026

CVE-2026-53318
Publication date:
26/06/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr()<br /> <br /> Move the NULL check for &amp;#39;sta&amp;#39; before dereferencing it to prevent a<br /> possible crash.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2026

CVE-2026-53319
Publication date:
26/06/2026
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> blk-wbt: remove WARN_ON_ONCE from wbt_init_enable_default()<br /> <br /> wbt_init_enable_default() uses WARN_ON_ONCE to check for failures from<br /> wbt_alloc() and wbt_init(). However, both are expected failure paths:<br /> <br /> - wbt_alloc() can return NULL under memory pressure (-ENOMEM)<br /> - wbt_init() can fail with -EBUSY if wbt is already registered<br /> <br /> syzbot triggers this by injecting memory allocation failures during MTD<br /> partition creation via ioctl(BLKPG), causing a spurious warning.<br /> <br /> wbt_init_enable_default() is a best-effort initialization called from<br /> blk_register_queue() with a void return type. Failure simply means the<br /> disk operates without writeback throttling, which is harmless.<br /> <br /> Replace WARN_ON_ONCE with plain if-checks, consistent with how<br /> wbt_set_lat() in the same file already handles these failures. Add a<br /> pr_warn() for the wbt_init() failure to retain diagnostic information<br /> without triggering a full stack trace.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2026
Subscribe to Vulnerabilities