Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-46419

Publication date:
24/04/2025
Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2025-46417

Publication date:
24/04/2025
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.get_server_certificate can exfiltrate data via DNS after deserialization.
Severity CVSS v4.0: MEDIUM
Last modification:
29/04/2025

CVE-2025-27580

Publication date:
24/04/2025
NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, time, and the fixed 7Dl9#dj- string) and thus allows unauthenticated users with a Common Access Card (CAC) to escalate privileges and compromise any account, including administrators.
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2025-27581

Publication date:
24/04/2025
NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET module via direct requests to known endpoints.
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2025-25045

Publication date:
23/04/2025
IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system.
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2025-25046

Publication date:
23/04/2025
IBM InfoSphere Information Server 11.7 DataStage Flow Designer <br /> <br /> transmits sensitive information via URL or query parameters that could be exposed to an unauthorized actor using man in the middle techniques.
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2024-22351

Publication date:
23/04/2025
IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025

CVE-2025-46399

Publication date:
23/04/2025
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
Severity CVSS v4.0: Pending analysis
Last modification:
30/04/2025

CVE-2025-46400

Publication date:
23/04/2025
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
Severity CVSS v4.0: Pending analysis
Last modification:
30/04/2025

CVE-2025-46397

Publication date:
23/04/2025
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
Severity CVSS v4.0: Pending analysis
Last modification:
30/04/2025

CVE-2025-46398

Publication date:
23/04/2025
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.
Severity CVSS v4.0: Pending analysis
Last modification:
30/04/2025

CVE-2025-28169

Publication date:
23/04/2025
BYD QIN PLUS DM-i Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 was discovered to cend broadcasts to the manufacturer&amp;#39;s cloud server unencrypted, allowing attackers to execute a man-in-the-middle attack.
Severity CVSS v4.0: Pending analysis
Last modification:
29/04/2025