Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-62805

Publication date:

23/10/2025

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

23/10/2025

CVE-2025-62806

Publication date:

23/10/2025

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

23/10/2025

CVE-2025-62807

Publication date:

23/10/2025

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

23/10/2025

CVE-2025-62808

Publication date:

23/10/2025

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

23/10/2025

CVE-2025-11575

Publication date:

23/10/2025

Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 through 2.0.0.

Severity CVSS v4.0: HIGH

Last modification:

27/10/2025

CVE-2025-62710

Publication date:

22/10/2025

Sakai is a Collaboration and Learning Environment. Prior to versions 23.5 and 25.0, EncryptionUtilityServiceImpl initialized an AES256TextEncryptor password (serverSecretKey) using RandomStringUtils with the default java.util.Random. java.util.Random is a non‑cryptographic PRNG and can be predicted from limited state/seed information (e.g., start time window), substantially reducing the effective search space of the generated key. An attacker who can obtain ciphertexts (e.g., exported or at‑rest strings protected by this service) and approximate the PRNG seed can feasibly reconstruct the serverSecretKey and decrypt affected data. SAK-49866 is patched in Sakai 23.5, 25.0, and trunk.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2025-62708

Publication date:

22/10/2025

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. This has been fixed in pypdf version 6.1.3.

Severity CVSS v4.0: MEDIUM

Last modification:

27/10/2025

CVE-2025-62707

Publication date:

22/10/2025

pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. This has been fixed in pypdf version 6.1.3.

Severity CVSS v4.0: MEDIUM

Last modification:

27/10/2025

CVE-2025-62705

Publication date:

22/10/2025

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao&#39;s audit log did not appropriately redact fields when relevant subsystems sent []byte response parameters rather than strings. This includes, but is not limited to sys/raw with use of encoding=base64, all data would be emitted unredacted to the audit log, and Transit, when performing a signing operation with a derived Ed25519 key, would emit public keys to the audit log. This issue has been patched in OpenBao 2.4.2.

Severity CVSS v4.0: MEDIUM

Last modification:

27/10/2025

CVE-2025-62706

Publication date:

22/10/2025

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2025-62617

Publication date:

22/10/2025

Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data retrieval functionality of Admidio. Any authenticated user with permissions to assign members to a role (such as an administrator) can exploit this vulnerability to execute arbitrary SQL commands. This can lead to a full compromise of the application&#39;s database, including reading, modifying, or deleting all data. This issue has been patched in version 4.3.17.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2025-62613

Publication date:

22/10/2025

VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scripting (XSS) vulnerability exists on examples/control.html through the room parameter, which is improperly sanitized before being rendered in the DOM. The application fails to validate and encode user input, allowing malicious scripts to be injected and executed. This issue has been patched in version 28.4.

Severity CVSS v4.0: MEDIUM

Last modification:

27/10/2025

Subscribe to Vulnerabilities