Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-25840

Publication date:

07/02/2026

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2026

CVE-2026-25841

Publication date:

07/02/2026

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2026

CVE-2026-25842

Publication date:

07/02/2026

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2026

CVE-2026-25843

Publication date:

07/02/2026

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2026

CVE-2026-25844

Publication date:

07/02/2026

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2026

CVE-2025-31990

Publication date:

07/02/2026

Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.

Severity CVSS v4.0: Pending analysis

Last modification:

09/02/2026

CVE-2026-2071

Publication date:

07/02/2026

A vulnerability was found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formP2PLimitConfig. Performing a manipulation of the argument except results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: HIGH

Last modification:

09/02/2026

CVE-2020-37166

Publication date:

07/02/2026

AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application. Attackers can overwrite the username field with a 1000-byte buffer, causing the application to become unresponsive and terminate.

Severity CVSS v4.0: MEDIUM

Last modification:

09/02/2026

CVE-2020-37170

Publication date:

07/02/2026

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy address configuration that allows local attackers to crash the application. Attackers can overwrite the address field with 3000 bytes of arbitrary data to trigger an application crash and prevent normal program functionality.

Severity CVSS v4.0: MEDIUM

Last modification:

09/02/2026

CVE-2020-37171

Publication date:

07/02/2026

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy username configuration that allows local attackers to crash the application. Attackers can overwrite the username field with 10,000 bytes of arbitrary data to trigger an application crash and prevent normal program functionality.

Severity CVSS v4.0: MEDIUM

Last modification:

09/02/2026

CVE-2020-37160

Publication date:

07/02/2026

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.

Severity CVSS v4.0: HIGH

Last modification:

09/02/2026

CVE-2020-37161

Publication date:

07/02/2026

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name field with malicious payload. Attackers can craft a specially designed payload to trigger remote code execution, demonstrating the ability to run system commands like launching the calculator.

Severity CVSS v4.0: HIGH

Last modification:

09/02/2026

Subscribe to Vulnerabilities