Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-11791

Publication date:

06/03/2026

Sensitive information disclosure and manipulation due to insufficient authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, macOS, Windows) before build 41186, Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.

Severity CVSS v4.0: Pending analysis

Last modification:

13/03/2026

CVE-2025-11792

Publication date:

06/03/2026

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 41124.

Severity CVSS v4.0: Pending analysis

Last modification:

13/03/2026

CVE-2025-11790

Publication date:

06/03/2026

Credentials are not deleted from Acronis Agent after plan revocation. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 41124.

Severity CVSS v4.0: Pending analysis

Last modification:

13/03/2026

CVE-2026-26125

Publication date:

05/03/2026

Payment Orchestrator Service Elevation of Privilege Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

16/03/2026

CVE-2026-26124

Publication date:

05/03/2026

&#39;.../...//&#39; in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

Severity CVSS v4.0: Pending analysis

Last modification:

16/03/2026

CVE-2026-26122

Publication date:

05/03/2026

Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network.

Severity CVSS v4.0: Pending analysis

Last modification:

16/03/2026

CVE-2026-23651

Publication date:

05/03/2026

Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

Severity CVSS v4.0: Pending analysis

Last modification:

16/03/2026

CVE-2026-21536

Publication date:

05/03/2026

Microsoft Devices Pricing Program Remote Code Execution Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

16/03/2026

CVE-2026-2593

Publication date:

05/03/2026

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `_gspb_post_css` post meta value and the `dynamicAttributes` block attribute in all versions up to, and including, 12.8.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

09/03/2026

CVE-2026-3606

Publication date:

05/03/2026

A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function add_data_segment of the file src/ettercap/utils/etterfilter/ef_output.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Severity CVSS v4.0: MEDIUM

Last modification:

16/03/2026

CVE-2026-29613

Publication date:

05/03/2026

OpenClaw versions prior to 2026.2.12 contain a vulnerability in the BlueBubbles (optional plugin) webhook handler in which it authenticates requests based solely on loopback remoteAddress without validating forwarding headers, allowing bypass of configured webhook passwords. When the gateway operates behind a reverse proxy, unauthenticated remote attackers can inject arbitrary BlueBubbles message and reaction events by reaching the proxy endpoint.

Severity CVSS v4.0: HIGH

Last modification:

11/03/2026

CVE-2026-29612

Publication date:

05/03/2026

OpenClaw versions prior to 2026.2.14 decode base64-backed media inputs into buffers before enforcing decoded-size budget limits, allowing attackers to trigger large memory allocations. Remote attackers can supply oversized base64 payloads to cause memory pressure and denial of service.

Severity CVSS v4.0: MEDIUM

Last modification:

11/03/2026

Subscribe to Vulnerabilities