Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-15146

Publication date:

10/07/2026

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2026

CVE-2025-30008

Publication date:

10/07/2026

HestiaCP before 1.9.5 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject arbitrary HTML by creating a DNS record with a double-quote followed by a script payload in the value field. The application fails to apply htmlspecialchars() encoding to the DNS record value field rendered into the data-sort-value HTML attribute in list_dns_rec.php, allowing the payload to execute in the browser of any user who views the DNS record list, including administrators.

Severity CVSS v4.0: MEDIUM

Last modification:

10/07/2026

CVE-2025-30007

Publication date:

10/07/2026

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to prematurely close a variable assignment string and achieve full root code execution on the underlying host in a single DNS record creation step.

Severity CVSS v4.0: HIGH

Last modification:

10/07/2026

CVE-2026-57474

Publication date:

10/07/2026

Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

Severity CVSS v4.0: MEDIUM

Last modification:

10/07/2026

CVE-2026-57475

Publication date:

10/07/2026

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

Severity CVSS v4.0: MEDIUM

Last modification:

10/07/2026

CVE-2026-57476

Publication date:

10/07/2026

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

Severity CVSS v4.0: MEDIUM

Last modification:

10/07/2026

CVE-2026-56666

Publication date:

10/07/2026

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL&#39;s external identity provider handler checks that the local user&#39;s email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email, allowing a permissive provider account with a victim email address to be linked to the victim&#39;s local account. This issue is fixed in version 4.15.3.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2026

CVE-2026-56668

Publication date:

10/07/2026

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL&#39;s OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token&#39;s scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application. This issue is fixed in version 4.15.3.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2026

CVE-2026-56665

Publication date:

10/07/2026

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and from 4.0.0-rc.1 through 4.15.1, ZITADEL&#39;s external JWT Identity Provider validation in internal/idp/providers/jwt/session.go skips expiration handling when an incoming token omits the exp claim, allowing a token from a trusted issuer to be treated as valid without an automatic expiration window. This issue is fixed in versions 3.4.12 and 4.15.2.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2026

CVE-2026-56667

Publication date:

10/07/2026

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user&#39;s browser when an affected login error path is reached. This issue is fixed in version 4.15.3.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2026

CVE-2026-55671

Publication date:

10/07/2026

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL&#39;s HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to loopback, internal IP, link-local, or redirected endpoints through DNS rebinding, redirects, or protocol downgrades. This issue is fixed in version 4.15.2.

Severity CVSS v4.0: LOW

Last modification:

10/07/2026

CVE-2026-55672

Publication date:

10/07/2026

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL&#39;s OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2026

Subscribe to Vulnerabilities