Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-25289

Publication date:

08/01/2026

SmartLiving SmartLAN

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2019-25290

Publication date:

08/01/2026

Smartliving SmartLAN/G/SI

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2019-25277

Publication date:

08/01/2026

FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the &#39;msg&#39; parameter of pluginInstall.php that allows attackers to inject malicious scripts. Attackers can exploit the unvalidated input to execute arbitrary JavaScript in victim browsers, potentially stealing authentication credentials and conducting phishing attacks.

Severity CVSS v4.0: MEDIUM

Last modification:

22/01/2026

CVE-2019-25278

Publication date:

08/01/2026

FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to intercept authentication credentials. Attackers can perform man-in-the-middle attacks to capture HTTP cookie authentication information during network communication.

Severity CVSS v4.0: CRITICAL

Last modification:

16/01/2026

CVE-2019-25231

Publication date:

08/01/2026

devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the &#39;DevoloNetworkService&#39; that allows local non-privileged users to potentially execute arbitrary code. Attackers can exploit the insecure service path configuration by inserting malicious code in the system root path to execute with elevated privileges during application startup or system reboot.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2019-25259

Publication date:

08/01/2026

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can trick logged-in users into executing unauthorized actions by crafting malicious web pages that submit requests to the application.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2019-25268

Publication date:

08/01/2026

NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files from remote shares. Attackers can exploit insecure library loading of sdl2.dll and libegl.dll by placing malicious libraries on WebDAV or SMB shares to execute unauthorized code.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2019-25270

Publication date:

08/01/2026

SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the &#39;senddata&#39; POST parameter of logged_page.php that allows attackers to inject malicious scripts. Attackers can exploit this weakness by sending crafted POST requests to execute arbitrary HTML and script code in a victim&#39;s browser session.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2017-20213

Publication date:

08/01/2026

FLIR Thermal Camera F/FC/PT/D Stream firmware version 8.0.0.64 contains an unauthenticated vulnerability that allows remote attackers to access live camera streams without credentials. Attackers can exploit the vulnerability to view unauthorized thermal camera video feeds across multiple camera series without requiring any authentication.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2017-20214

Publication date:

08/01/2026

FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains hard-coded SSH credentials that cannot be changed through normal camera operations. Attackers can leverage these persistent, unmodifiable credentials to gain unauthorized remote access to the thermal camera system.

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

CVE-2017-20215

Publication date:

08/01/2026

FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell commands with root privileges. Authenticated attackers can inject arbitrary shell commands through unvalidated input parameters to gain complete control of the thermal camera system.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2017-20216

Publication date:

08/01/2026

FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem.php script. Attackers can execute arbitrary system commands as root by exploiting unsanitized POST parameters in the execFlirSystem() function through shell_exec() calls. Exploitation evidence was observed by the Shadowserver Foundation on 2026-01-06 (UTC).

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

Subscribe to Vulnerabilities