Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-88837

Publication date:

23/09/2026

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2026

CVE-2026-88839

Publication date:

23/09/2026

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2026

CVE-2026-88840

Publication date:

23/09/2026

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2026

CVE-2026-86867

Publication date:

23/09/2026

Cinnamon&#39;s Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester&#39;s `user_id` to the conversation&#39;s owner `Conversation.user`. This allows any authenticated user to perform the following actions:<br /> 1. Read other user&#39;s chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions.<br /> 2. Permanently delete another user&#39;s conversation.<br /> 3. Rename another user&#39;s conversation.<br /> 4. Overwrite another user&#39;s conversation&#39;s chat suggestion list.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-86938

Publication date:

23/09/2026

A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3.

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2026

CVE-2026-86934

Publication date:

23/09/2026

An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2026

CVE-2026-86930

Publication date:

23/09/2026

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3.

Severity CVSS v4.0: Pending analysis

Last modification:

05/10/2026

CVE-2026-86926

Publication date:

23/09/2026

A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed in FileMaker Server version 26.0.3.

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2026

CVE-2026-18944

Publication date:

23/09/2026

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-18944. Reason: This candidate is a reservation duplicate of CVE-2026-18944. Notes: All CVE users should reference CVE-2026-18944 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2026

CVE-2026-96808

Publication date:

23/09/2026

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session&#39;s directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-96804

Publication date:

23/09/2026

MLflow&#39;s statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

Severity CVSS v4.0: Pending analysis

Last modification:

24/09/2026

CVE-2026-96775

Publication date:

23/09/2026

MLflow&#39;s dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

Severity CVSS v4.0: Pending analysis

Last modification:

23/09/2026

Subscribe to Vulnerabilities