Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-65084

Publication date:

25/08/2026

NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, code execution, and escalation of privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-65085

Publication date:

25/08/2026

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-65086

Publication date:

25/08/2026

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-65087

Publication date:

25/08/2026

NVIDIA NemoClaw contains a vulnerability where an attacker could cause<br /> insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-65088

Publication date:

25/08/2026

NVIDIA NemoClaw contains a vulnerability where an attacker could cause<br /> invocation of process using visible sensitive information. A successful exploit of this vulnerability might lead to information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-65089

Publication date:

25/08/2026

NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-65090

Publication date:

25/08/2026

NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-65081

Publication date:

25/08/2026

NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, information disclosure, and denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-65082

Publication date:

25/08/2026

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

28/08/2026

CVE-2026-55588

Publication date:

25/08/2026

ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded recursion and memory growth. This affects oras discover, whose recursive traversal is enabled by default because the --depth option defaults to 0 (unlimited), as well as the recursive referrer counting used by the oras backup and oras restore workflows. A cyclic graph can be as simple as A referring to B and B referring back to A. A malicious registry can use this to cause a client-side denial of service, exhausting CPU and memory and hanging automation or CI/CD pipelines that run ORAS against untrusted registry metadata. The vulnerability does not extend to code execution, artifact substitution, or integrity bypass. This issue has been fixed in version 1.3.3.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2026

CVE-2026-51368

Publication date:

25/08/2026

An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimdall endpoint

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2026

CVE-2026-53965

Publication date:

25/08/2026

The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer with no upper bound. The buffer is only flushed when an SSE event delimiter, a double newline, is found, so a remote MCP server that streams response bytes without ever sending the delimiter causes the buffer to grow without limit. A malicious, compromised, or man-in-the-middle-controlled server that the client connects to over the HTTP transport can exploit this to exhaust the client process&#39;s memory, triggering a fatal allocation error or OS out-of-memory kill and denying service to the MCP client. The issue affects any client using HttpTransport against an untrusted server endpoint and does not require authentication or user interaction beyond initiating the connection. This issue is fixed in version 0.7.1.

Severity CVSS v4.0: MEDIUM

Last modification:

26/08/2026

Subscribe to Vulnerabilities