Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-86734

Publication date:

08/09/2026

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86730

Publication date:

08/09/2026

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86729

Publication date:

08/09/2026

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users_id field in the response body discloses the authenticated identity (users_id:1 on success, users_id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover.

Severity CVSS v4.0: CRITICAL

Last modification:

08/09/2026

CVE-2026-86725

Publication date:

08/09/2026

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin&#39;s add.json.php endpoint that allows authenticated users to modify other users&#39; OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user&#39;s stored access_token and refresh_token, then delete the compromised record to destroy the victim&#39;s provider linkage.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86728

Publication date:

08/09/2026

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playlist IDs to retrieve sensitive credentials, server identifiers, and complete programme schedules without authentication.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86726

Publication date:

08/09/2026

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers&#39; active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86724

Publication date:

08/09/2026

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user&#39;s wallet balance to any value.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86727

Publication date:

08/09/2026

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86723

Publication date:

08/09/2026

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() that uses loose comparison (==) instead of strict comparison (===) against unset session values. Attackers with only a password can submit an empty request to verifyChallenge.json.php to bypass PGP two-factor authentication and gain full authenticated access.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86721

Publication date:

08/09/2026

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named &#39;key&#39; with value &#39;value&#39; overrides the $_REQUEST[&#39;key&#39;] parameter in saveLive.php and related endpoints. Attackers can publish to any user&#39;s RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86722

Publication date:

08/09/2026

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

CVE-2026-86718

Publication date:

08/09/2026

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or mark streams as finished when an admin visits the attacker-controlled site.

Severity CVSS v4.0: HIGH

Last modification:

08/09/2026

Subscribe to Vulnerabilities