Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-20936

Publication date:
08/04/2025
Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their privileges to root.
Severity CVSS v4.0: Pending analysis
Last modification:
22/01/2026

CVE-2025-20938

Publication date:
08/04/2025
Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContacts.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2026

CVE-2025-20939

Publication date:
08/04/2025
Improper authorization in wireless download protocol in Galaxy Watch prior to SMR Apr-2025 Release 1 allows physical attackers to update device unique identifier of Watch devices.
Severity CVSS v4.0: Pending analysis
Last modification:
27/01/2026

CVE-2025-20940

Publication date:
08/04/2025
Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers to access provider in SDMHS.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-20941

Publication date:
08/04/2025
Improper access control in InputManager to SMR Apr-2025 Release 1 allows local attackers to access the scancode of specific input device.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2026

CVE-2025-20942

Publication date:
08/04/2025
Improper Verification of Intent by Broadcast Receiver in DeviceIdService prior to SMR Apr-2025 Release 1 allows local attackers to reset OAID.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2026

CVE-2025-20943

Publication date:
08/04/2025
Out-of-bounds write in secfr trustlet prior to SMR Apr-2025 Release 1 allows local privileged attackers to cause memory corruption.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2026

CVE-2025-20944

Publication date:
08/04/2025
Out-of-bounds read in parsing audio data in libsavsac.so prior to SMR Apr-2025 Release 1 allows local attackers to read out-of-bounds memory.
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2026

CVE-2024-13820

Publication date:
08/04/2025
The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information, plugin tokens, shipping configurations, and limited vendor information.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-20934

Publication date:
08/04/2025
Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege.
Severity CVSS v4.0: Pending analysis
Last modification:
30/04/2025

CVE-2025-20935

Publication date:
08/04/2025
Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access files with system privilege. User interaction is required for triggering this vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-3408

Publication date:
08/04/2025
A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: MEDIUM
Last modification:
19/05/2026