Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-33020

Publication date:

23/07/2025

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highly sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2025-33076

Publication date:

23/07/2025

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2025-33077

Publication date:

23/07/2025

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2025-36116

Publication date:

23/07/2025

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthenticated malicious actor could exploit this vulnerability to sniff an existing WebSocket connection to then remotely perform operations that the user is not allowed to perform.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2025-36117

Publication date:

23/07/2025

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the system.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2025-54090

Publication date:

23/07/2025

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2025-40599

Publication date:

23/07/2025

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote attacker with administrative privileges can exploit this flaw to upload arbitrary files to the system, potentially leading to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2025-46099

Publication date:

23/07/2025

In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2017-20198

Publication date:

23/07/2025

The Marathon UI in DC/OS

Severity CVSS v4.0: CRITICAL

Last modification:

23/07/2025

CVE-2018-25113

Publication date:

23/07/2025

An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user.

Severity CVSS v4.0: HIGH

Last modification:

23/07/2025

CVE-2018-25114

Publication date:

23/07/2025

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and missing authentication in the installer workflow. By default, the /install/ directory remains accessible after installation. An unauthenticated attacker can invoke install_4.php, submit crafted POST data, and inject arbitrary PHP code into the configure.php file. When the application later includes this file, the injected payload is executed, resulting in full server-side compromise.

Severity CVSS v4.0: CRITICAL

Last modification:

23/07/2025

CVE-2022-4978

Publication date:

23/07/2025

Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration. The server exposes a custom UDP-based control protocol that accepts remote keyboard input events without verification. An attacker on the same network can issue a sequence of keystroke commands to launch a system shell and execute arbitrary commands, resulting in full system compromise.

Severity CVSS v4.0: CRITICAL

Last modification:

23/07/2025

Subscribe to Vulnerabilities