Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-63178

Publication date:

17/08/2026

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition&#39;s PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-45790

Publication date:

17/08/2026

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy&#39;s organization.inviteMember tRPC procedure in apps/dokploy/server/api/routers/organization.ts allows a user with member:create permission to invite an account with the owner role, while packages/server/src/services/user.ts allows a privileged self-hosted user to create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted. This issue is fixed in version 0.29.6.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-45791

Publication date:

17/08/2026

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy&#39;s user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-51977

Publication date:

17/08/2026

An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-54385

Publication date:

17/08/2026

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-56677

Publication date:

17/08/2026

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-43794

Publication date:

17/08/2026

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-43795

Publication date:

17/08/2026

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-43667

Publication date:

17/08/2026

A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An attacker in a privileged network position may be able to cause a denial-of-service.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-42163

Publication date:

17/08/2026

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026

CVE-2026-28984

Publication date:

17/08/2026

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processing maliciously crafted web content may lead to an unexpected Safari crash.

Severity CVSS v4.0: Pending analysis

Last modification:

17/08/2026