Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-52296

Publication date:

13/09/2026

FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-52297

Publication date:

13/09/2026

FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-35867

Publication date:

13/09/2026

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/set_LimitClient_cfg" call but does not already have administrative access to the device.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-36989

Publication date:

13/09/2026

A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-37008

Publication date:

13/09/2026

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python&#39;s complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-38332

Publication date:

13/09/2026

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-36453

Publication date:

13/09/2026

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2025-70820

Publication date:

13/09/2026

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2025-45480

Publication date:

13/09/2026

Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2025-70819

Publication date:

13/09/2026

Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a compose file.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2020-15875

Publication date:

13/09/2026

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the searchPhrase parameter in the /ajax_table.php API endpoint. This affects as-selection.inc.php, edit-ports.inc.php, alertlog-stats.inc.php, alerts.inc.php, eventlog.inc.php, inventory.inc.php, ix-list.inc.php, ix-peers.inc.php, mempool-edit.inc.php, mempool.inc.php, poll-log.inc.php, processor-edit.inc.php, processor.inc.php, routing-edit.inc.php, sensors-common.inc.php, storage-edit.inc.php, storage.inc.php, and toner.inc.php (in includes/html/table). NOTE: some sources refer to this as CVE-2020-15876, but CVE-2020-15875 is the only correct CVE ID.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-90525

Publication date:

13/09/2026

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Severity CVSS v4.0: LOW

Last modification:

20/09/2026

Subscribe to Vulnerabilities