Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-25552

Publication date:

21/03/2026

CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by submitting an excessively long buffer to the password field. Attackers can paste a large string of repeated characters into the password input during the upload process to trigger an application crash.

Severity CVSS v4.0: HIGH

Last modification:

10/04/2026

CVE-2019-25550

Publication date:

21/03/2026

Encrypt PDF 2.3 contains a buffer overflow vulnerability that allows local attackers to crash the application by inputting excessively long strings into password fields. Attackers can paste a 1000-byte buffer into the User Password or Master Password field in the Settings dialog to trigger an application crash when importing PDF files.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2019-25551

Publication date:

21/03/2026

Sandboxie 5.30 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Program Alerts configuration field. Attackers can paste a buffer of 5000 characters into the &#39;Select or enter a program&#39; field during program alert configuration to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2019-25554

Publication date:

21/03/2026

Tomabo MP4 Converter 3.25.22 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can trigger a buffer overflow by pasting a large payload into the Name parameter when adding a preset in the Video/Audio Formats options, causing the application to crash when Reset All is clicked.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2019-25545

Publication date:

21/03/2026

Terminal Services Manager 3.2.1 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an excessively long string in the computer name field. Attackers can input a 5000-byte buffer of data into the &#39;Computer name or IP address&#39; field during computer addition, causing a denial of service when the server entry is accessed.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2019-25546

Publication date:

21/03/2026

NetAware 1.20 contains a buffer overflow vulnerability in the Share Name field that allows local attackers to crash the application by supplying an excessively long string. Attackers can trigger a denial of service by pasting a 1000-byte buffer into the Share Name parameter when adding a new share through the Manage Shares interface.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2019-25547

Publication date:

21/03/2026

NetAware 1.20 contains a buffer overflow vulnerability in the User Blocking feature that allows local attackers to crash the application by supplying oversized input. Attackers can paste a malicious buffer of 512 bytes into the &#39;Add a website or keyword to be filtered&#39; field and trigger a crash when removing the created block.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2019-25548

Publication date:

21/03/2026

BlueStacks 4.80.0.1060 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to the search field. Attackers can paste a buffer of 100,000 &#39;A&#39; characters into the search field and trigger a search operation to cause the application to crash.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2019-25549

Publication date:

21/03/2026

VeryPDF PCL Converter 2.7 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long password string. Attackers can trigger a buffer overflow by entering a 3000-byte password in the PDF Security encryption fields, causing the application to crash when processing PCL files.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2019-25544

Publication date:

21/03/2026

Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during account creation. Attackers can input a buffer of 1000 characters in the username field and trigger a crash when joining a chat, causing the application to become unavailable.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2026-4515

Publication date:

21/03/2026

A vulnerability has been found in Foundation Agents MetaGPT up to 0.8.1. This affects the function code_generate of the file metagpt/ext/aflow/scripts/operator.py. The manipulation leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

CVE-2026-4514

Publication date:

21/03/2026

A flaw has been found in PbootCMS up to 3.2.12. Affected by this issue is some unknown functionality of the file apps/admin/controller/system/UserController.php of the component Backend. Executing a manipulation of the argument Field can lead to improper access controls. The attack may be performed from remote. The exploit has been published and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

23/03/2026

Subscribe to Vulnerabilities