Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-52910

Publication date:

04/11/2025

An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1330, 1380, 1480, 2400. A Use-After-Free leads to privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

CVE-2025-47776

Publication date:

04/11/2025

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code in versions 2.27.1 and below.PHP type juggling will cause certain MD5 hashes matching scientific notation to be interpreted as numbers. Instances using the MD5 login method allow an attacker who knows the victim&#39;s username and has access to an account with a password hash that evaluates to zero to log in without knowing the victim&#39;s actual password, by using any other password with a hash that also evaluates to zero This issue is fixed in version 2.27.2.

Severity CVSS v4.0: HIGH

Last modification:

10/11/2025

CVE-2025-48884

Publication date:

04/11/2025

Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette&#39;s Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.

Severity CVSS v4.0: MEDIUM

Last modification:

10/11/2025

CVE-2025-48076

Publication date:

04/11/2025

Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.

Severity CVSS v4.0: MEDIUM

Last modification:

10/11/2025

CVE-2025-27374

Publication date:

04/11/2025

An issue was discovered in the Secure Boot component in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850, 1080, 1280, 2200, 1330, 1380, 1480, 2400. The lack of a length check leads to out-of-bounds writes.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

CVE-2025-32786

Publication date:

04/11/2025

The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerable to SQL Injection. This issue is fixed in version 1.5.1.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-56426

Publication date:

04/11/2025

An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, W920, W930, W1000. The lack of a length check leads to out-of-bounds writes via malformed USB packets to the target.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

CVE-2025-61431

Publication date:

04/11/2025

A reflected cross-site scripted (XSS) vulnerability in the /jsp/gsfr_feditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 and earlier allows attackers to execute arbitrary Javascript in the context of a user&#39;s browser via injecting a crafted payload into the pHtmlSource parameter. A vendor fix was released on 2025-06-18.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2026

CVE-2025-54327

Publication date:

04/11/2025

An issue was discovered in VTS in Samsung Mobile Processor and Wearable Processor Exynos 1280, 2200, 1380, W920, W930, W1000. Improper input validation in the VTS driver leads to an arbitrary write.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

CVE-2025-49494

Publication date:

04/11/2025

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 2100, 1280, 2200, 1330, 1380, 1480, 9110, Modem 5123. Mishandling of an 5G NRMM packet leads to a Denial of Service.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

CVE-2025-23358

Publication date:

04/11/2025

NVIDIA NVApp for Windows contains a vulnerability in the installer, where a local attacker can cause a search path element issue. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-33176

Publication date:

04/11/2025

NVIDIA RunAI for all platforms contains a vulnerability where a user could cause an improper restriction of communications channels on an adjacent network. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, and information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

Subscribe to Vulnerabilities