Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-1837

Publication date:

11/02/2026

A specially-crafted file can cause libjxl&#39;s decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.<br /> <br /> This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

Severity CVSS v4.0: HIGH

Last modification:

11/02/2026

CVE-2025-64075

Publication date:

11/02/2026

A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2025-12474

Publication date:

11/02/2026

A specially-crafted file can cause libjxl&#39;s decoder to read pixel data from uninitialized (but allocated) memory.<br /> <br /> This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.

Severity CVSS v4.0: LOW

Last modification:

11/02/2026

CVE-2026-2345

Publication date:

11/02/2026

Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener(&#39;message&#39;, ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2026-2248

Publication date:

11/02/2026

METIS WIC devices (versions

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2026-2249

Publication date:

11/02/2026

METIS DFS devices (versions

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2026-2250

Publication date:

11/02/2026

The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2026-2344

Publication date:

11/02/2026

A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1

Severity CVSS v4.0: HIGH

Last modification:

11/02/2026

CVE-2025-48518

Publication date:

11/02/2026

Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service.

Severity CVSS v4.0: MEDIUM

Last modification:

11/02/2026

CVE-2025-52541

Publication date:

11/02/2026

A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2025-61969

Publication date:

11/02/2026

Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Severity CVSS v4.0: HIGH

Last modification:

11/02/2026

CVE-2025-48503

Publication date:

11/02/2026

A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

Subscribe to Vulnerabilities