Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-69562

Publication date:
27/01/2026
code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2026

CVE-2025-69563

Publication date:
27/01/2026
code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2026

CVE-2026-24875

Publication date:
27/01/2026
Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026

CVE-2026-24869

Publication date:
27/01/2026
Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026

CVE-2026-24832

Publication date:
27/01/2026
Out-of-bounds Write vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026

CVE-2026-24870

Publication date:
27/01/2026
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026

CVE-2026-24871

Publication date:
27/01/2026
Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-Rcon-Manage: before 3.0.
Severity CVSS v4.0: CRITICAL
Last modification:
27/01/2026

CVE-2026-24872

Publication date:
27/01/2026
improper pointer arithmetic<br /> <br /> vulnerability in ProjectSkyfire SkyFire_548.This issue affects SkyFire_548: before 5.4.8-stable5.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026

CVE-2026-24873

Publication date:
27/01/2026
Out-of-bounds Read vulnerability in Rinnegatamante lpp-vita.This issue affects lpp-vita: before lpp-vita r6.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026

CVE-2026-24874

Publication date:
27/01/2026
Access of Resource Using Incompatible Type (&amp;#39;Type Confusion&amp;#39;) vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026

CVE-2026-24868

Publication date:
27/01/2026
Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
28/01/2026

CVE-2026-22796

Publication date:
27/01/2026
Issue summary: A type confusion vulnerability exists in the signature<br /> verification of signed PKCS#7 data where an ASN1_TYPE union member is<br /> accessed without first validating the type, causing an invalid or NULL<br /> pointer dereference when processing malformed PKCS#7 data.<br /> <br /> Impact summary: An application performing signature verification of PKCS#7<br /> data or calling directly the PKCS7_digest_from_attributes() function can be<br /> caused to dereference an invalid or NULL pointer when reading, resulting in<br /> a Denial of Service.<br /> <br /> The function PKCS7_digest_from_attributes() accesses the message digest attribute<br /> value without validating its type. When the type is not V_ASN1_OCTET_STRING,<br /> this results in accessing invalid memory through the ASN1_TYPE union, causing<br /> a crash.<br /> <br /> Exploiting this vulnerability requires an attacker to provide a malformed<br /> signed PKCS#7 to an application that verifies it. The impact of the<br /> exploit is just a Denial of Service, the PKCS7 API is legacy and applications<br /> should be using the CMS API instead. For these reasons the issue was<br /> assessed as Low severity.<br /> <br /> The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,<br /> as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module<br /> boundary.<br /> <br /> OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026