Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-119122

Publication date:

29/10/2026

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.

Severity CVSS v4.0: MEDIUM

Last modification:

29/10/2026

CVE-2026-119120

Publication date:

29/10/2026

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file to execute Python code under PyTorch below 2.6, or exhaust disk and memory.

Severity CVSS v4.0: HIGH

Last modification:

03/11/2026

CVE-2026-119119

Publication date:

29/10/2026

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to hold browser pages or stall the rate limiter, exhausting the page pool and blocking other crawls.

Severity CVSS v4.0: HIGH

Last modification:

04/11/2026

CVE-2026-119123

Publication date:

29/10/2026

ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing denial of service.

Severity CVSS v4.0: MEDIUM

Last modification:

04/11/2026

CVE-2026-118082

Publication date:

29/10/2026

Subscriber Privilege Escalation in Buddyboss Platform

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2026

CVE-2026-118083

Publication date:

29/10/2026

Unauthenticated Sensitive Data Exposure in WP Crowdfunding

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2026

CVE-2026-118084

Publication date:

29/10/2026

Subscriber Insecure Direct Object References (IDOR) in Hotel Booking

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2026

CVE-2026-118085

Publication date:

29/10/2026

Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2026

CVE-2026-118673

Publication date:

29/10/2026

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though Botan::Sodium::crypto_box_easy() writes the plaintext length plus crypto_box_MACBYTES. A browser-protocol client that can access the per-user IPC endpoint, has a valid database association, and causes an unlocked database to generate and encrypt a sufficiently large authorized response can trigger a sequential out-of-bounds write before any response is delivered. This issue is fixed in version 2.8.0.

Severity CVSS v4.0: MEDIUM

Last modification:

03/11/2026