Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-25748

Publication date:

12/02/2026

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible to bypass authentication when using forward authentication in the authentik Proxy Provider when used in conjunction with Traefik or Caddy as reverse proxy. When a malicious cookie was used, none of the authentik-specific X-Authentik-* headers were set which depending on application can grant access to an attacker. authentik 2025.10.4 and 2025.12.4 fix this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2026-25767

Publication date:

12/02/2026

LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymaker” tag, could create shovels bypassing access controls. an authenticated user with the "Policymaker" management tag could exploit it to read messages from vhosts they are not authorized to access or publish messages to vhosts they are not authorized to access. This vulnerability is fixed in 2.6.8.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2026-25768

Publication date:

12/02/2026

LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadata in the broker they should not have access to. This vulnerability is fixed in 2.6.6.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2026-25922

Publication date:

12/02/2026

authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source that has the option Verify Assertion Signature under Verification Certificate enabled and not Verify Response Signature, or does not have the Encryption Certificate setting under Advanced Protocol settings configured, it was possible for an attacker to inject a malicious assertion before the signed assertion that authentik would use instead. authentik 2025.8.6, 2025.10.4, and 2025.12.4 fix this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2026-24044

Publication date:

12/02/2026

Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Helm Chart secrets initialization hook (using matrix-tools container before 0.5.7) is using an insecure Matrix server key generation method, allowing network attackers to potentially recreate the same key pair, allowing them to impersonate the victim server. The secret is generated by the secrets initialization hook, in the ESS Community Helm Chart values, if both initSecrets.enabled is not set to false and synapse.signingKey is not defined. Given a server key in Matrix authenticates both requests originating from and events constructed on a given server, this potentially impacts confidentiality, integrity and availability of rooms which have a vulnerable server present as a member. The confidentiality of past conversations in end-to-end encrypted rooms is not impacted. The key generation issue was fixed in matrix-tools 0.5.7, released as part of ESS Community Helm Chart 25.12.1.

Severity CVSS v4.0: CRITICAL

Last modification:

12/02/2026

CVE-2025-70314

Publication date:

12/02/2026

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2025-67433

Publication date:

12/02/2026

A heap buffer overflow in the processRequest function of Open TFTP Server MultiThreaded v1.7 allows attackers to cause a Denial of Service (DoS) via a crafted DATA packet.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2025-67432

Publication date:

12/02/2026

A stack overflow in the ZBarcode_Encode function of Monkeybread Software MBS DynaPDF Plugin v21.3.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2026

CVE-2019-25344

Publication date:

12/02/2026

Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory. Attackers can replace the original MobileGo.exe with a malicious executable to create a new user account and add it to the Administrators group with full system access.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25345

Publication date:

12/02/2026

Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in the service configuration to inject malicious executables and escalate privileges on the system.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25346

Publication date:

12/02/2026

TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the &#39;server_name&#39; parameter. Attackers can inject malicious SQL code like &#39; or &#39;1=1 to retrieve unauthorized database records and potentially access sensitive system information.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

CVE-2019-25347

Publication date:

12/02/2026

thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can inject malicious SQL code like &#39; or &#39;1=1 to the username field to gain unauthorized access to user accounts.

Severity CVSS v4.0: HIGH

Last modification:

12/02/2026

Subscribe to Vulnerabilities