Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-81627

Publication date:

18/09/2026

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

Severity CVSS v4.0: Pending analysis

Last modification:

21/09/2026

CVE-2026-87743

Publication date:

18/09/2026

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2026

CVE-2026-93494

Publication date:

18/09/2026

A flaw was found in Netty&#39;s StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2026

CVE-2026-75157

Publication date:

18/09/2026

Apache Airflow&#39;s asset queued-events DELETE endpoints checked the caller&#39;s Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag&#39;s queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing action gated on a read-only permission. Deployments are affected whenever asset-triggered scheduling is in use and Dag read access is granted more widely than Dag edit access, which is the normal RBAC arrangement; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

Severity CVSS v4.0: Pending analysis

Last modification:

22/09/2026

CVE-2026-89058

Publication date:

18/09/2026

A flaw was found in RESTEasy&#39;s CorsFilter, which, when configured to allow all origins ("*"), reflects the request&#39;s Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim&#39;s session, resulting in a loss of confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-89059

Publication date:

18/09/2026

A flaw was found in RESTEasy&#39;s IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

13/10/2026

CVE-2026-67103

Publication date:

18/09/2026

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim&#39;s browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2026

CVE-2026-67102

Publication date:

18/09/2026

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2026

CVE-2026-67101

Publication date:

18/09/2026

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2026

CVE-2026-67100

Publication date:

18/09/2026

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2026

CVE-2024-38639

Publication date:

18/09/2026

An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system. QTS is not affected. We have already fixed the vulnerability in the following version:

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2026

CVE-2024-27123

Publication date:

18/09/2026

A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later

Severity CVSS v4.0: MEDIUM

Last modification:

28/09/2026

Subscribe to Vulnerabilities