Display of information in the Forocoches comments editor Fri, 10/30/2026 - 09:49 Aviso Affected Resources Comment editor. Description INCIBE has coordinated the disclosure of a high-severity vulnerability affecting the Forocoches comment editor, a component used to create and edit comments in discussion threads. The vulnerability was discovered by Miguel Jiménez. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type: CVE-2026-14467…
De multiples vulnérabilités ont été découvertes dans les produits Apple. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données.
SQL injection (SQLi) in the user authentication module of Futurum Software Wed, 10/28/2026 - 09:52 Aviso Affected Resources User authentication module for the business management platform. Description INCIBE has coordinated the disclosure of a critical severity vulnerability affecting the user authentication module of Futurum Software, a cloud-based business management platform designed to create and manage multi-level marketing businesses. The vulnerability was discovered by Diego González…
A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause a denial-of-service condition. The following versions of J4Care dcm4che are affected: dcm4chee-arc-light 5.35.1 (CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, CVE-2026-105667) CVSS Vendor Equipment v3 9.1 J4Care dcm4chee-arc-light…
Unauthorised disclosure of information on Copart’s online billing service Wed, 10/14/2026 - 09:27 Aviso Affected Resources Customer invoicing web service. Description INCIBE has coordinated the disclosure of a critical vulnerability affecting Copart’s invoicing web service, a platform that connects sellers with buyers worldwide. The vulnerability was discovered by Mario Romeo Lázaro. This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability…
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform. The following versions of Viidure Dashcam Android Application are affected: Dashcam Android Application <=3.3.1.260403 (CVE-2026-94204, CVE-2026-96587) CVSS Vendor Equipment Vulnerabilities v3 10 Viidure Viidure Dashcam Android Application Incorrect Permission Assignment…
De multiples vulnérabilités ont été découvertes dans Mattermost Server. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un problème de sécurité non spécifié par l'éditeur.
Inadequate access control in the Hiperdino REST API Mon, 09/14/2026 - 13:27 Aviso Affected Resources Hiperdino REST API v1.0. Description INCIBE has coordinated the disclosure of a critical-severity vulnerability affecting the Hiperdino REST API, which acts as a bridge for carrying out actions automatically and in real time. The vulnerability was discovered by Jorge Ramos Santana.This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability…
Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally.
Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.