Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-47377

Publication date:
02/03/2026
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
Severity CVSS v4.0: Pending analysis
Last modification:
04/03/2026

CVE-2025-47375

Publication date:
02/03/2026
Memory corruption while handling different IOCTL calls from the user-space simultaneously.
Severity CVSS v4.0: Pending analysis
Last modification:
02/03/2026

CVE-2025-47376

Publication date:
02/03/2026
Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.
Severity CVSS v4.0: Pending analysis
Last modification:
04/03/2026

CVE-2025-47371

Publication date:
02/03/2026
Transient DOS when an LTE RLC packet with invalid TB is received by UE.
Severity CVSS v4.0: Pending analysis
Last modification:
02/03/2026

CVE-2025-47373

Publication date:
02/03/2026
Memory Corruption when accessing buffers with invalid length during TA invocation.
Severity CVSS v4.0: Pending analysis
Last modification:
02/03/2026

CVE-2026-26699

Publication date:
02/03/2026
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.
Severity CVSS v4.0: Pending analysis
Last modification:
03/03/2026

CVE-2026-26701

Publication date:
02/03/2026
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.
Severity CVSS v4.0: Pending analysis
Last modification:
03/03/2026

CVE-2026-26720

Publication date:
02/03/2026
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.
Severity CVSS v4.0: Pending analysis
Last modification:
04/03/2026

CVE-2026-28403

Publication date:
02/03/2026
Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.1:`) accepts connections from any origin without validating the HTTP `Origin` header during the WebSocket handshake. A malicious web page visited in the same browser session can silently connect to the local WebSocket server and send arbitrary `DirectorCommand` payloads, allowing full remote control of the teleprompter content. Version 1.5.1 fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
04/03/2026

CVE-2026-28412

Publication date:
02/03/2026
Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server with connections, causing the Textream application to freeze and crash during a live session. Version 1.5.1 fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
04/03/2026

CVE-2026-24110

Publication date:
02/03/2026
An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsIP, dhcpsMac);`, the lack of size validation for the rules could lead to buffer overflows in `dhcpsIndex`, `dhcpsIP`, and `dhcpsMac`.
Severity CVSS v4.0: Pending analysis
Last modification:
03/03/2026

CVE-2026-24101

Publication date:
02/03/2026
An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a command injection vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
03/03/2026