Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-70029

Publication date:

11/02/2026

An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. The application disables TLS/SSL certificate validation by setting &#39;rejectUnauthorized&#39;: false in HTTP request options

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2025-70085

Publication date:

11/02/2026

An issue was discovered in OpenSatKit 2.2.1. The EventErrStr buffer has a fixed size of 256 bytes. The code uses sprintf to format two filenames (Source1Filename and the string returned by FileUtil_FileStateStr) into this buffer without any length checking and without using bounded format specifiers such as %.*s. If the filename length approaches OS_MAX_PATH_LEN (commonly 64-256 bytes), the combined formatted string together with constant text can exceed 256 bytes, resulting in a stack buffer overflow. Such unsafe sprintf calls are scattered across multiple functions in file.c, including FILE_ConcatenateCmd() and ConcatenateFiles(), all of which fail to validate the output length.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2026

CVE-2025-70084

Publication date:

11/02/2026

Directory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files via crafted value to the FileUtil_GetFileInfo function.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2026

CVE-2025-70083

Publication date:

11/02/2026

An issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by the ground segment and must be treated as untrusted input. The program copies DirName into the local buffer DirWithSep using strcpy. The size of this buffer is OS_MAX_PATH_LEN. If the length of DirName is greater than or equal to OS_MAX_PATH_LEN, a stack buffer overflow occurs, overwriting adjacent stack memory. The path length check (FileUtil_AppendPathSep) is performed after the strcpy operation, meaning the validation occurs too late and cannot prevent the overflow.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2026

CVE-2025-69874

Publication date:

11/02/2026

nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2025-65480

Publication date:

11/02/2026

An issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious scripts in the Report Templates which are executed when certain script conditions are fulfilled, leading to Remote Code Execution.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2025-65128

Publication date:

11/02/2026

A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers on the local network to modify router and network configurations. By invoking operations whose names end with "*_nocommit" and supplying the parameters expected by the invoked function, an attacker can change configuration data, including SSID, Wi-Fi credentials, and administrative passwords, without authentication or an existing session.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2026

CVE-2026-24789

Publication date:

11/02/2026

An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.

Severity CVSS v4.0: CRITICAL

Last modification:

11/02/2026

CVE-2026-25084

Publication date:

11/02/2026

Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.

Severity CVSS v4.0: CRITICAL

Last modification:

11/02/2026

CVE-2025-65127

Publication date:

11/02/2026

A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access administrative information-retrieval functions intended for authenticated users. By invoking "get_*" operations, attackers can obtain device configuration data, including plaintext credentials, without authentication or an existing session.

Severity CVSS v4.0: Pending analysis

Last modification:

17/02/2026

CVE-2025-13391

Publication date:

11/02/2026

The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the &#39;uni_cpo_remove_file&#39; function in all versions up to, and including, 4.9.60. This makes it possible for unauthenticated attackers to delete arbitrary attachments or files stored in Dropbox if the file path is known. The vulnerability was partially patched in version 4.9.60.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2026

CVE-2026-25868

Publication date:

11/02/2026

MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response. Successful exploitation can lead to execution of arbitrary script in a victim&#39;s browser in the context of the vulnerable application.

Severity CVSS v4.0: MEDIUM

Last modification:

11/02/2026

Subscribe to Vulnerabilities