Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-48535

Publication date:

23/07/2026

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.

Severity CVSS v4.0: MEDIUM

Last modification:

23/07/2026

CVE-2026-48533

Publication date:

23/07/2026

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-16584

Publication date:

23/07/2026

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on the configured credentials remain in effect and are unaffected. To remediate this issue, users should upgrade to version 1.3.47.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2026

CVE-2026-15612

Publication date:

23/07/2026

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-15614

Publication date:

23/07/2026

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-15615

Publication date:

23/07/2026

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-15616

Publication date:

23/07/2026

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-15617

Publication date:

23/07/2026

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-15611

Publication date:

23/07/2026

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-11804

Publication date:

23/07/2026

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse. This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-43820

Publication date:

23/07/2026

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert&#39;s SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

CVE-2026-43823

Publication date:

23/07/2026

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2026

Subscribe to Vulnerabilities