Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-57052
Publication date:
03/09/2025
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
Severity CVSS v4.0: Pending analysis
Last modification:
08/09/2025

CVE-2025-56608
Publication date:
03/09/2025
The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.
Severity CVSS v4.0: Pending analysis
Last modification:
08/09/2025

CVE-2025-9822
Publication date:
03/09/2025
SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.<br /> <br /> ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2025

CVE-2025-47421
Publication date:
03/09/2025
Improper Neutralization of Argument Delimiters in a Command (&amp;#39;Argument Injection&amp;#39;) vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001.<br /> <br /> A specially crafted SCP command sent via SSH login string can lead a valid administrator user to gain Privileged Operating System access on the device.<br /> <br /> <br /> Following Products Models are affected:<br /> <br /> TSW-x70 <br /> TSW-x60 <br /> TST-1080<br /> AM-3000/3100/3200<br /> Soundbar VB70<br /> HD-PS622/621/402<br /> HD-TXU-RXU-4kZ-211<br /> HD-MDNXM-4KZ-E<br /> <br /> *Note: additional firmware updates will be published once made available
Severity CVSS v4.0: HIGH
Last modification:
04/09/2025

CVE-2025-2416
Publication date:
03/09/2025
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass.This issue affects LimonDesk: from s1.02.14 before v1.02.17.
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2025

CVE-2025-26210
Publication date:
03/09/2025
DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior.
Severity CVSS v4.0: Pending analysis
Last modification:
08/09/2025

CVE-2025-0878
Publication date:
03/09/2025
Improper Neutralization of Input During Web Page Generation (XSS or &amp;#39;Cross-site Scripting&amp;#39;) vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XSS).This issue affects LimonDesk: from s1.02.14 before v1.02.17.
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2025

CVE-2024-13068
Publication date:
03/09/2025
Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing.This issue affects LimonDesk: from s1.02.14 before v1.02.17.
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2025

CVE-2025-9901
Publication date:
03/09/2025
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2025

CVE-2025-3701
Publication date:
03/09/2025
Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Malcure Malware Scanner: from n/a through 16.8.
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2025

CVE-2025-53694
Publication date:
03/09/2025
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Severity CVSS v4.0: Pending analysis
Last modification:
08/09/2025

CVE-2025-53693
Publication date:
03/09/2025
Use of Externally-Controlled Input to Select Classes or Code (&amp;#39;Unsafe Reflection&amp;#39;) vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Severity CVSS v4.0: Pending analysis
Last modification:
08/09/2025
Subscribe to Vulnerabilities