Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-47183

Publication date:

07/08/2025

In GStreamer through 1.26.1, the isomp4 plugin&#39;s qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2025

CVE-2025-47219

Publication date:

07/08/2025

In GStreamer through 1.26.1, the isomp4 plugin&#39;s qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2025

CVE-2025-47806

Publication date:

07/08/2025

In GStreamer through 1.26.1, the subparse plugin&#39;s parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2025

CVE-2025-47807

Publication date:

07/08/2025

In GStreamer through 1.26.1, the subparse plugin&#39;s subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2025

CVE-2025-47808

Publication date:

07/08/2025

In GStreamer through 1.26.1, the subparse plugin&#39;s tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2025

CVE-2025-55077

Publication date:

07/08/2025

Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.

Severity CVSS v4.0: MEDIUM

Last modification:

23/09/2025

CVE-2025-8697

Publication date:

07/08/2025

A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPSessionManager/MCPTool/MCPToolkit. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: MEDIUM

Last modification:

07/08/2025

CVE-2025-7195

Publication date:

07/08/2025

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. <br /> <br /> In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Severity CVSS v4.0: Pending analysis

Last modification:

13/11/2025

CVE-2025-50675

Publication date:

07/08/2025

GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory. The directory is accessible with full read, write, and execute permissions for all users, allowing unprivileged users to manipulate files within the directory, including executable files like GPMAW3.exe, Fragment.exe, and the uninstaller GPsetup64_17028.exe. An attacker with user-level access can exploit this misconfiguration by replacing or modifying the uninstaller (GPsetup64_17028.exe) with a malicious version. While the application itself runs in the user&#39;s context, the uninstaller is typically executed with administrative privileges when an administrator attempts to uninstall the software. By exploiting this flaw, an attacker could gain administrative privileges and execute arbitrary code in the context of the admin, resulting in privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2025

CVE-2025-50692

Publication date:

07/08/2025

FoxCMS

Severity CVSS v4.0: Pending analysis

Last modification:

14/08/2025

CVE-2025-51533

Publication date:

07/08/2025

An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2025

CVE-2025-51629

Publication date:

07/08/2025

A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Temp parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

07/08/2025

Subscribe to Vulnerabilities