Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-11817

Publication date:

17/08/2026

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.

Severity CVSS v4.0: MEDIUM

Last modification:

17/08/2026

CVE-2026-75531

Publication date:

17/08/2026

Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to HTML escaping by the template engine, it was embedded inside a JavaScript string within an HTML attribute. An attacker-controlled URL containing specially crafted characters could therefore break out of the JavaScript string and inject arbitrary JavaScript code. The malicious script would execute in the context of the Pandora web application when a victim interacts with the affected Submit to Lookyloo control. Successful exploitation could allow an attacker to access information available to the victim&#39;s browser or perform actions using the victim&#39;s authenticated Pandora session. The patch removes the observable value from the inline JavaScript handler. The URL is instead stored in an HTML data-url attribute and retrieved through the DOM dataset API when needed. Additional uses of innerHTML were also replaced with textContent as defensive hardening.

Severity CVSS v4.0: HIGH

Last modification:

17/08/2026

CVE-2026-75529

Publication date:

17/08/2026

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora&#39;s content-based file-type detection, but previously returned the file using send_file(task.file.path) without explicitly specifying the MIME type or forcing it to be downloaded as an attachment. Because Flask determines the response MIME type from the filename when a path is supplied, an attacker could submit a file whose content is recognized by Pandora as a PDF while its filename or extension causes the download endpoint to return it with a different, potentially active MIME type. A specially crafted PDF/polyglot file could therefore be served inline and interpreted by a victim&#39;s browser as HTML or another executable web format. If a victim with access to the submitted analysis follows the PDF download link, attacker-controlled script could execute in the security context of the Pandora application, potentially allowing access to application data or actions using the victim&#39;s session. The patch prevents the issue by explicitly returning PDF downloads with Content-Type: application/pdf, forcing Content-Disposition: attachment, and assigning a trusted .pdf filename based on the task UUID.

Severity CVSS v4.0: MEDIUM

Last modification:

17/08/2026

CVE-2026-75483

Publication date:

17/08/2026

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.

Severity CVSS v4.0: MEDIUM

Last modification:

17/08/2026

CVE-2026-75110

Publication date:

17/08/2026

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints.

Severity CVSS v4.0: CRITICAL

Last modification:

17/08/2026

CVE-2026-75111

Publication date:

17/08/2026

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.

Severity CVSS v4.0: HIGH

Last modification:

17/08/2026

CVE-2026-75479

Publication date:

17/08/2026

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.

Severity CVSS v4.0: HIGH

Last modification:

17/08/2026

CVE-2026-75480

Publication date:

17/08/2026

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges.

Severity CVSS v4.0: HIGH

Last modification:

17/08/2026

CVE-2026-75481

Publication date:

17/08/2026

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users and workspaces.

Severity CVSS v4.0: HIGH

Last modification:

17/08/2026

CVE-2026-75482

Publication date:

17/08/2026

SWE-agent&#39;s trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory (&#39;..&#39;) references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network client (or a malicious web page via CORS) can use path traversal sequences to read files outside the intended directory. Because the read sink parses targets as trajectory JSON, disclosure is constrained to JSON files shaped like a trajectory, which can contain repository contents, command output, and secrets/API keys.

Severity CVSS v4.0: HIGH

Last modification:

17/08/2026

CVE-2026-75103

Publication date:

17/08/2026

Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account&#39;s password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution.

Severity CVSS v4.0: HIGH

Last modification:

17/08/2026

CVE-2026-75104

Publication date:

17/08/2026

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

Severity CVSS v4.0: MEDIUM

Last modification:

17/08/2026

Subscribe to Vulnerabilities