Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-69559
Publication date:
27/01/2026
code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php.
Severity CVSS v4.0: Pending analysis
Last modification:
03/02/2026

CVE-2025-65264
Publication date:
27/01/2026
The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a crafted request.
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2026

CVE-2026-24875
Publication date:
27/01/2026
Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2026

CVE-2026-24871
Publication date:
27/01/2026
Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-Rcon-Manage: before 3.0.
Severity CVSS v4.0: CRITICAL
Last modification:
29/01/2026

CVE-2026-24873
Publication date:
27/01/2026
Out-of-bounds Read vulnerability in Rinnegatamante lpp-vita.This issue affects lpp-vita: before lpp-vita r6.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2026

CVE-2026-24874
Publication date:
27/01/2026
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2026

CVE-2026-24869
Publication date:
27/01/2026
Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
30/01/2026

CVE-2026-24872
Publication date:
27/01/2026
improper pointer arithmetic<br /> <br /> vulnerability in ProjectSkyfire SkyFire_548.This issue affects SkyFire_548: before 5.4.8-stable5.
Severity CVSS v4.0: Pending analysis
Last modification:
04/02/2026

CVE-2026-24870
Publication date:
27/01/2026
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2026

CVE-2026-24832
Publication date:
27/01/2026
Out-of-bounds Write vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2026

CVE-2026-24868
Publication date:
27/01/2026
Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2026

CVE-2026-0648
Publication date:
27/01/2026
The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get_counter(). Specifically, the current code checks if cntr_id equals 0u to determine failure, but @osek_get_counter() actually returns E_OS_SYS_STACK (defined as 12U) when it fails. This mismatch causes the error branch to never execute even when the counter pool is exhausted.<br /> <br /> As a result, when the counter pool is depleted, the code proceeds to cast the error code (12U) to a pointer (OSEK_COUNTER *), creating a wild pointer. Subsequent writes to members of this pointer lead to writes to illegal memory addresses (e.g., 0x0000000C), which can trigger immediate HardFaults or silent memory corruption.<br /> <br /> This vulnerability poses significant risks, including potential denial-of-service attacks (via repeated calls to exhaust the counter pool) and unauthorized memory access.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2026
Subscribe to Vulnerabilities