Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-42644

Publication date:

29/07/2025

FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publish object is greater than 0.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2025

CVE-2024-42645

Publication date:

29/07/2025

An issue in FlashMQ v1.14.0 allows attackers to cause an assertion failure via sending a crafted retain message, leading to a Denial of Service (DoS).

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2025

CVE-2025-6060

Publication date:

29/07/2025

Improper Neutralization of Input During Web Page Generation (XSS or &#39;Cross-site Scripting&#39;) vulnerability in DECE Software Geodi allows Cross-Site Scripting (XSS).This issue affects Geodi: before GEODI Setup 9.0.146.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-6175

Publication date:

29/07/2025

Improper Neutralization of CRLF Sequences (&#39;CRLF Injection&#39;) vulnerability in DECE Software Geodi allows HTTP Request Splitting.This issue affects Geodi: before GEODI Setup 9.0.146.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-7458

Publication date:

29/07/2025

An integer overflow in the sqlite3KeyInfoFromExprList function in SQLite versions 3.39.2 through 3.41.1 allows an attacker with the ability to execute arbitrary SQL statements to cause a denial of service or disclose sensitive information from process memory via a crafted SELECT statement with a large number of expressions in the ORDER BY clause.

Severity CVSS v4.0: MEDIUM

Last modification:

11/08/2025

CVE-2025-6504

Publication date:

29/07/2025

In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range. This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.

Severity CVSS v4.0: Pending analysis

Last modification:

02/10/2025

CVE-2025-6505

Publication date:

29/07/2025

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software&#39;s Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. When OAuth Clients perform an OAuth handshake with the Hybrid Data Pipeline Server, the server accepts client credentials from both HTTP headers and request parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

02/10/2025

CVE-2025-40686

Publication date:

29/07/2025

Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in the victim&#39;s browser by sending a malicious URL through the &#39;employeeid&#39; parameter in/detailview.php.

Severity CVSS v4.0: MEDIUM

Last modification:

04/08/2025

CVE-2025-41241

Publication date:

29/07/2025

VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this vulnerability to create a denial-of-service condition.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-54422

Publication date:

29/07/2025

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vulnerability exists in password handling mechanisms. During encrypted sandbox creation, user passwords are transmitted via shared memory, exposing them to potential interception. The vulnerability is particularly severe during password modification operations, where both old and new passwords are passed as plaintext command-line arguments to the Imbox process without any encryption or obfuscation. This implementation flaw allows any process within the user session, including unprivileged processes, to retrieve these sensitive credentials by reading the command-line arguments, thereby bypassing standard privilege requirements and creating a significant security risk. This is fixed in version 1.16.2.

Severity CVSS v4.0: MEDIUM

Last modification:

04/08/2025

CVE-2025-40682

Publication date:

29/07/2025

SQL injection vulnerability in Human Resource Management System version 1.0, which allows an attacker to retrieve, create, update and delete databases via the “city” and “state” parameters in the /controller/ccity.php endpoint.

Severity CVSS v4.0: HIGH

Last modification:

04/08/2025

CVE-2025-40683

Publication date:

29/07/2025

Severity CVSS v4.0: MEDIUM

Last modification:

04/08/2025

Subscribe to Vulnerabilities