Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-53415
Publication date:
30/06/2025
Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution
Severity CVSS v4.0: Pending analysis
Last modification:
01/07/2025

CVE-2025-40734
Publication date:
30/06/2025
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Severity CVSS v4.0: MEDIUM
Last modification:
07/07/2025

CVE-2025-40733
Publication date:
30/06/2025
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
Severity CVSS v4.0: MEDIUM
Last modification:
07/07/2025

CVE-2025-40732
Publication date:
30/06/2025
user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php
Severity CVSS v4.0: HIGH
Last modification:
07/07/2025

CVE-2025-40731
Publication date:
30/06/2025
SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.
Severity CVSS v4.0: HIGH
Last modification:
07/07/2025

CVE-2025-6898
Publication date:
30/06/2025
A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the file in proxy_client.asp. The manipulation of the argument proxy_srv/proxy_lanport/proxy_lanip/proxy_srvport leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
14/07/2025

CVE-2025-38088
Publication date:
30/06/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap<br /> <br /> memtrace mmap issue has an out of bounds issue. This patch fixes the by<br /> checking that the requested mapping region size should stay within the<br /> allocated region size.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2025

CVE-2025-38090
Publication date:
30/06/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drivers/rapidio/rio_cm.c: prevent possible heap overwrite<br /> <br /> In<br /> <br /> riocm_cdev_ioctl(RIO_CM_CHAN_SEND)<br /> -&gt; cm_chan_msg_send()<br /> -&gt; riocm_ch_send()<br /> <br /> cm_chan_msg_send() checks that userspace didn&amp;#39;t send too much data but<br /> riocm_ch_send() failed to check that userspace sent sufficient data. The<br /> result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr<br /> which were outside the bounds of the space which cm_chan_msg_send()<br /> allocated.<br /> <br /> Address this by teaching riocm_ch_send() to check that the entire<br /> rio_ch_chan_hdr was copied in from userspace.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2025

CVE-2025-6897
Publication date:
30/06/2025
A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_debug.asp. The manipulation of the argument Time leads to os command injection. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
01/07/2025

CVE-2025-38089
Publication date:
30/06/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sunrpc: handle SVC_GARBAGE during svc auth processing as auth error<br /> <br /> tianshuo han reported a remotely-triggerable crash if the client sends a<br /> kernel RPC server a specially crafted packet. If decoding the RPC reply<br /> fails in such a way that SVC_GARBAGE is returned without setting the<br /> rq_accept_statp pointer, then that pointer can be dereferenced and a<br /> value stored there.<br /> <br /> If it&amp;#39;s the first time the thread has processed an RPC, then that<br /> pointer will be set to NULL and the kernel will crash. In other cases,<br /> it could create a memory scribble.<br /> <br /> The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate<br /> or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531<br /> says that if authentication fails that the RPC should be rejected<br /> instead with a status of AUTH_ERR.<br /> <br /> Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of<br /> AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This<br /> sidesteps the whole problem of touching the rpc_accept_statp pointer in<br /> this situation and avoids the crash.
Severity CVSS v4.0: Pending analysis
Last modification:
03/07/2025

CVE-2025-38087
Publication date:
30/06/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: fix use-after-free in taprio_dev_notifier<br /> <br /> Since taprio’s taprio_dev_notifier() isn’t protected by an<br /> RCU read-side critical section, a race with advance_sched()<br /> can lead to a use-after-free.<br /> <br /> Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.
Severity CVSS v4.0: Pending analysis
Last modification:
30/06/2025

CVE-2025-6891
Publication date:
30/06/2025
A vulnerability classified as critical has been found in code-projects Inventory Management System 1.0. Affected is an unknown function of the file /php_action/createUser.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
08/07/2025
Subscribe to Vulnerabilities