Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-77422
Publication date:
23/09/2026
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-75131
Publication date:
23/09/2026
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object.
Severity CVSS v4.0: HIGH
Last modification:
24/09/2026

CVE-2026-76087
Publication date:
23/09/2026
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-76089
Publication date:
23/09/2026
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-76086
Publication date:
23/09/2026
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.
Severity CVSS v4.0: Pending analysis
Last modification:
30/09/2026

CVE-2026-71464
Publication date:
23/09/2026
LaunchConfigurationBaseSerializer.scm_branch has no<br /> validate_scm_branch() leading-dash check, unlike<br /> Project/JobTemplate/JobLaunch serializers. Schedule and<br /> WFJT Node accept --upload-pack=/bin/id as scm_branch.<br /> Currently blocked at runtime by jobs.py:1502 ValueError<br /> check (defense-in-depth), but the API validation gap<br /> means sole reliance on a task-layer guard. Refactoring<br /> that guard away would promote this to RCE.
Severity CVSS v4.0: Pending analysis
Last modification:
24/09/2026

CVE-2026-71465
Publication date:
23/09/2026
RunAdHocCommand.build_args() appends limit as bare<br /> positional (args.append(limit)) instead of using<br /> args.extend([&amp;#39;-l&amp;#39;, limit]) like RunJob. A limit beginning<br /> with - is parsed as an ansible CLI option. Currently<br /> limited to short-circuit flags (--version, --help) since<br /> injected element displaces required pattern positional.<br /> Would escalate if ansible-core ever defaults pattern.
Severity CVSS v4.0: Pending analysis
Last modification:
24/09/2026

CVE-2026-71462
Publication date:
23/09/2026
StringListPathField.to_internal_value() calls<br /> os.path.exists() on unbounded user-supplied paths.<br /> 200 vs 400 response reveals existence of arbitrary<br /> absolute paths on the controller-web pod. Tenant<br /> superuser can confirm /etc/tower/SECRET_KEY, k8s<br /> service-account token, receptor sockets, ConfigMap<br /> mount points. Mainly impactful on managed AAP<br /> (ansiblecloud.com) where tenant admin != host admin.
Severity CVSS v4.0: Pending analysis
Last modification:
24/09/2026

CVE-2026-71463
Publication date:
23/09/2026
Notification template Jinja AST whitelist only inspects<br /> static Getattr nodes. Dynamic subscripts (job[&amp;#39;job&amp;#39;+&amp;#39;_env&amp;#39;])<br /> and {% if job.id &gt; 100 %} conditional gating bypass both<br /> the AST check and the test-render (stub has small job.id).<br /> At runtime, the gated branch executes and exceptions write<br /> full tracebacks into notification body, which is POSTed<br /> to attacker-controlled webhook URL. Leaks install paths,<br /> Python version, source line numbers.
Severity CVSS v4.0: Pending analysis
Last modification:
25/09/2026

CVE-2026-71460
Publication date:
23/09/2026
/api/v2/config/ is protected only by IsAuthenticated.<br /> license_info (account_number, subscription_id, pool_id,<br /> sku, support_level, instance counts) returned to any<br /> authenticated user. The superuser/auditor gate only covers<br /> project_base_dir/project_local_paths/custom_virtualenvs,<br /> not license_info. Enables social engineering against<br /> Red Hat support and estate sizing reconnaissance.
Severity CVSS v4.0: Pending analysis
Last modification:
24/09/2026

CVE-2026-71459
Publication date:
23/09/2026
JobJobEventsChildrenSummary view has no model/parent_model.<br /> ModelAccessPermission.check_get_permissions() falls through<br /> (returns True) for any authenticated user. The view uses<br /> raw get_object_or_404(Job, pk) without DRF object-level<br /> permission check. Zero-privilege user reads event tree<br /> structure, event_processing_finished status, and enumerates<br /> Job IDs platform-wide via 200/404 oracle. Sibling endpoint<br /> /jobs/{id}/job_events/ correctly returns 403.
Severity CVSS v4.0: Pending analysis
Last modification:
25/09/2026

CVE-2026-71461
Publication date:
23/09/2026
HostList.list() catches bare Exception and returns str(e)<br /> verbatim. Via host_filter, any authenticated user triggers<br /> Django FieldError (leaking complete Host model relation<br /> graph including internal reverse accessors) or PostgreSQL<br /> DataError (leaking raw database error strings). Two<br /> primitives: credential__search=x dumps ORM schema,<br /> name__regex=[bad reflects PostgreSQL errors.
Severity CVSS v4.0: Pending analysis
Last modification:
26/09/2026
Subscribe to Vulnerabilities