Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-25331

Publication date:

12/02/2026

AVS Audio Converter 9.1 contains a local buffer overflow vulnerability that allows local attackers to overwrite CPU registers by manipulating the &#39;Exit folder&#39; input field. Attackers can craft a specially designed text file with 264 bytes of padding followed by register overwrite values to compromise the application and potentially execute arbitrary code.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2019-25323

Publication date:

12/02/2026

Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the outputtitle parameter. Attackers can craft specially formatted POST requests to the outputtitle parameter to execute arbitrary HTML and potentially manipulate the web interface&#39;s displayed content.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2019-25324

Publication date:

12/02/2026

RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to inject malicious HTML code. Attackers can exploit the entryNameIn and entryDisplayNameIn parameters to insert arbitrary HTML content, potentially enabling cross-site scripting attacks.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2019-25325

Publication date:

12/02/2026

Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by manipulating the &#39;user&#39; POST parameter. Attackers can inject malicious SQL code like &#39; or 1=1# to manipulate login queries and gain unauthorized access to the application.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2019-25327

Publication date:

12/02/2026

Prime95 version 29.8 build 6 contains a buffer overflow vulnerability in the user ID input field that allows remote attackers to execute arbitrary code. Attackers can craft a malicious payload and paste it into the PrimeNet user ID and proxy host fields to trigger a bind shell on port 3110.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2019-25328

Publication date:

12/02/2026

XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the application. Attackers can generate a 9000-byte buffer of repeated characters and paste it into the registration code field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2019-25321

Publication date:

12/02/2026

FTP Navigator 8.03 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload that triggers a buffer overflow when pasted into the Custom Command textbox, enabling remote code execution and launching the calculator as proof of concept.

Severity CVSS v4.0: HIGH

Last modification:

03/03/2026

CVE-2019-25319

Publication date:

12/02/2026

Domain Quester Pro 6.02 contains a stack overflow vulnerability that allows remote attackers to execute arbitrary code by overwriting Structured Exception Handler (SEH) registers. Attackers can craft a malicious payload targeting the &#39;Domain Name Keywords&#39; input field to trigger an access violation and execute a bind shell on port 9999.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2019-25320

Publication date:

12/02/2026

E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating login parameters. Attackers can exploit the /login.php file by sending a specific payload &#39;=&#39;&#39;or&#39; to bypass authentication and gain unauthorized access to the system.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2019-25322

Publication date:

12/02/2026

Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials. Attackers can access the device by using the hard-coded username &#39;admin&#39; and password &#39;admin&#39; in the hidden form input fields.

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

CVE-2019-25318

Publication date:

12/02/2026

AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the output folder text input. Attackers can craft a malicious payload that overwrites stack memory and triggers a bind shell on port 9999 when the &#39;Browse&#39; button is clicked.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2026-26185

Publication date:

12/02/2026

Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.

Severity CVSS v4.0: Pending analysis

Last modification:

20/02/2026

Subscribe to Vulnerabilities