Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-52978

Publication date:

24/06/2025

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2025

CVE-2025-52979

Publication date:

24/06/2025

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2025

CVE-2025-6559

Publication date:

24/06/2025

Multiple wireless router models from Sapido have an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. The affected models are out of support; replacing the device is recommended.

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

CVE-2025-6560

Publication date:

24/06/2025

Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. <br /> <br /> The affected models are out of support; replacing the device is recommended.

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

CVE-2025-6552

Publication date:

24/06/2025

A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the function doLogin of the file /src/main/java/com/hope/controller/WebController.java of the component Login. The manipulation of the argument redirect_url leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: LOW

Last modification:

29/04/2026

CVE-2025-48466

Publication date:

24/06/2025

Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks.

Severity CVSS v4.0: Pending analysis

Last modification:

09/07/2025

CVE-2025-48467

Publication date:

24/06/2025

Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unavailability.

Severity CVSS v4.0: Pending analysis

Last modification:

09/07/2025

CVE-2025-48468

Publication date:

24/06/2025

Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware.

Severity CVSS v4.0: Pending analysis

Last modification:

09/07/2025

CVE-2025-48469

Publication date:

24/06/2025

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

09/07/2025

CVE-2025-48470

Publication date:

24/06/2025

Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

09/07/2025

CVE-2025-52971

Publication date:

24/06/2025

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

24/06/2025

CVE-2025-52560

Publication date:

24/06/2025

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.

Severity CVSS v4.0: Pending analysis

Last modification:

13/01/2026

Subscribe to Vulnerabilities