Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-22205

Publication date:

26/02/2026

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.

Severity CVSS v4.0: HIGH

Last modification:

02/03/2026

CVE-2026-22207

Publication date:

26/02/2026

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access administrative functions including account management, resource operations, and system configuration.

Severity CVSS v4.0: CRITICAL

Last modification:

07/04/2026

CVE-2023-31364

Publication date:

26/02/2026

Improper handling of direct memory writes in the input-output memory management unit could allow a malicious guest virtual machine (VM) to flood a host with writes, potentially causing a fatal machine check error resulting in denial of service.

Severity CVSS v4.0: HIGH

Last modification:

27/02/2026

CVE-2026-27141

Publication date:

26/02/2026

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-27510

Publication date:

26/02/2026

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLite database (unitree_go2.db, table dog_programme) and transmits the programme_text content, including the pyCode field, to the robot. The robot&#39;s actuator_manager.py executes the supplied Python as root without integrity verification or content validation. An attacker with local access to the Android device can tamper with the stored programme record to inject arbitrary Python that executes when the user triggers the program via a controller keybinding, and the malicious binding persists across reboots. Additionally, a malicious program shared through the application&#39;s community marketplace can result in arbitrary code execution on any robot that imports and runs it.

Severity CVSS v4.0: MEDIUM

Last modification:

12/03/2026

CVE-2026-27509

Publication date:

26/02/2026

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

Severity CVSS v4.0: HIGH

Last modification:

12/03/2026

CVE-2026-26979

Publication date:

26/02/2026

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don&#39;t have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Severity CVSS v4.0: NONE

Last modification:

02/03/2026

CVE-2026-26973

Publication date:

26/02/2026

Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `ReviewableNotesController`. When `enable_category_group_moderation` is enabled, a user belonging to a category moderation group can create or delete their own notes on **any** reviewable in the system, including reviewables in categories they do not moderate. The controller used an unscoped `Reviewable.find` and the `ensure_can_see` guard only checked whether the user could access the review queue in general, not whether they could access the specific reviewable. Only instances with `enable_category_group_moderation` enabled are affected. Staff users (admins/moderators) are not impacted as they already have access to all reviewables. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by scoping the reviewable lookup through `Reviewable.viewable_by(current_user)`. As a workaround, disable the `enable_category_group_moderation` site setting. This removes the attack surface as only staff users will have access to the review queue.

Severity CVSS v4.0: Pending analysis

Last modification:

02/03/2026

CVE-2026-23939

Publication date:

26/02/2026

Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability in hexpm hexpm/hexpm (&#39;Elixir.Hexpm.Store.Local&#39; module) allows Relative Path Traversal. This vulnerability is associated with program files lib/hexpm/store/local.ex and program routines &#39;Elixir.Hexpm.Store.Local&#39;:get/3, &#39;Elixir.Hexpm.Store.Local&#39;:put/4, &#39;Elixir.Hexpm.Store.Local&#39;:delete/2, &#39;Elixir.Hexpm.Store.Local&#39;:delete_many/2.<br /> <br /> This issue does NOT affect hex.pm the service. Only self-hosted deployments using the Local Storage backend are affected.<br /> <br /> This issue affects hexpm: from 931ee0ed46fa89218e0400a4f6e6d15f96406050 before 5d2ccd2f14f45a63225a73fb5b1c937baf36fdc0.

Severity CVSS v4.0: MEDIUM

Last modification:

06/04/2026

CVE-2026-1565

Publication date:

26/02/2026

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the &#39;WPUF_Admin_Settings::check_filetype_and_ext&#39; function and in the &#39;Admin_Tools::check_filetype_and_ext&#39; function in all versions up to, and including, 4.2.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-1241

Publication date:

26/02/2026

The Pelco, Inc. Sarix Professional 3 Series Cameras are vulnerable to an authentication bypass issue in their web management interface. The flaw stems from inadequate enforcement of access controls, allowing certain functionality to be accessed without proper authentication. This weakness can lead to unauthorized viewing of live video streams, creating privacy concerns and operational risks for organizations relying on these cameras. Additionally, it may expose operators to regulatory and compliance challenges.

Severity CVSS v4.0: HIGH

Last modification:

27/02/2026