Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-76596

Publication date:

22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik

Severity CVSS v4.0: HIGH

Last modification:

24/08/2026

CVE-2026-76597

Publication date:

22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik

Severity CVSS v4.0: HIGH

Last modification:

24/08/2026

CVE-2026-76598

Publication date:

22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik

Severity CVSS v4.0: HIGH

Last modification:

24/08/2026

CVE-2026-76600

Publication date:

22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik

Severity CVSS v4.0: MEDIUM

Last modification:

24/08/2026

CVE-2026-6258

Publication date:

22/08/2026

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Severity CVSS v4.0: Pending analysis

Last modification:

22/08/2026

CVE-2026-76571

Publication date:

22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik

Severity CVSS v4.0: CRITICAL

Last modification:

24/08/2026

CVE-2026-76599

Publication date:

22/08/2026

Joomla Extension - fabrikar.com - Unauthenticated database table list and table-prefix disclosure in Fabrik

Severity CVSS v4.0: HIGH

Last modification:

24/08/2026

CVE-2026-70626

Publication date:

22/08/2026

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place symlinks inside the corpus root to access files outside the intended boundary.

Severity CVSS v4.0: HIGH

Last modification:

24/08/2026

CVE-2026-74584

Publication date:

22/08/2026

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: zero shared page before exposing to userspace bnxt_re_alloc_ucontext() allocates uctx->shpg via __get_free_page(GFP_KERNEL). The buddy allocator does not zero pages without __GFP_ZERO, so the page contains stale kernel data from whatever object most recently freed it. The page is then mapped into userspace via vm_insert_page() under BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes 4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed to userspace unsanitised, leaking kernel memory contents. Any user with access to /dev/infiniband/uverbsX on a host with a bnxt_re device (typically rdma group membership) can read this data via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT. Other shared pages in the same file already use get_zeroed_page() correctly: drivers/infiniband/hw/bnxt_re/ib_verbs.c srq->uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL); cq->uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL); uctx->shpg is the only outlier. Bring it in line with the existing convention by switching to get_zeroed_page().

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2026

CVE-2026-68767

Publication date:

22/08/2026

hashcat&#39;s fgetl() function in src/filehandling.c writes a null terminator one byte past the caller&#39;s buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ_LARGE bytes.

Severity CVSS v4.0: MEDIUM

Last modification:

22/08/2026

CVE-2026-68766

Publication date:

22/08/2026

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-controlled content to arbitrary files, enabling code execution when targeting shell startup files.

Severity CVSS v4.0: HIGH

Last modification:

24/08/2026

CVE-2026-68768

Publication date:

22/08/2026

hashcat contains a heap-based buffer overflow (out-of-bounds write) in the outfile_write() function in src/outfile.c. When assembling output into a fixed-size buffer (HCBUFSIZ_LARGE, ~16 MB), the function sequentially appends the username, separator, hash, and plaintext via memcpy without validating that the accumulated length stays within the buffer capacity. When run with --username --show against a crafted hash file containing an oversized username that nearly fills the buffer, the total assembled output exceeds the buffer, causing a heap buffer overflow that can corrupt memory and crash the process.

Severity CVSS v4.0: MEDIUM

Last modification:

24/08/2026

Subscribe to Vulnerabilities