Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-52977

Publication date:
24/06/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2025-52978

Publication date:
24/06/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2025-52979

Publication date:
24/06/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2025-48466

Publication date:
24/06/2025
Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2025

CVE-2025-48467

Publication date:
24/06/2025
Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unavailability.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2025

CVE-2025-48468

Publication date:
24/06/2025
Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2025

CVE-2025-48469

Publication date:
24/06/2025
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2025

CVE-2025-48470

Publication date:
24/06/2025
Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2025

CVE-2025-52560

Publication date:
24/06/2025
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2025

CVE-2025-52574

Publication date:
24/06/2025
SysmonElixir is a system monitor HTTP service in Elixir. Prior to version 1.0.1, the /read endpoint reads any file from the server's /etc/passwd by default. In v1.0.1, a whitelist was added that limits reading to only files under priv/data. This issue has been patched in version 1.0.1.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2025

CVE-2025-52971

Publication date:
24/06/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2025-48461

Publication date:
24/06/2025
Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords.
Severity CVSS v4.0: Pending analysis
Last modification:
26/06/2025