Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-8090

Publication date:

13/01/2026

Null pointer dereference in the MsgRegisterEvent() system call could allow an attacker with local access and code execution abilities to crash the QNX Neutrino kernel.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-64155

Publication date:

13/01/2026

An improper neutralization of special elements used in an os command (&#39;os command injection&#39;) vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through 6.7.10 may allow an attacker to execute unauthorized code or commands via crafted TCP requests.

Severity CVSS v4.0: Pending analysis

Last modification:

20/01/2026

CVE-2025-59922

Publication date:

13/01/2026

An improper neutralization of special elements used in an SQL command (&#39;SQL Injection&#39;) vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2026

CVE-2025-65784

Publication date:

13/01/2026

Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users&#39; information via a crafted API request.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2026

CVE-2025-67685

Publication date:

13/01/2026

A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an authenticated attacker to proxy internal requests limited to plaintext endpoints only via crafted HTTP requests.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2026

CVE-2025-62182

Publication date:

13/01/2026

Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potentially upload a malicious file.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2025-25652

Publication date:

13/01/2026

In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2026

CVE-2025-46684

Publication date:

13/01/2026

Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2026

CVE-2025-46685

Publication date:

13/01/2026

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2026

CVE-2025-58409

Publication date:

13/01/2026

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kernel and drivers running on the platform altering their behaviour. This attack can lead the GPU to perform write operations on restricted internal GPU buffers that can lead to a second order affect of corrupted arbitrary physical memory.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2026

CVE-2025-58411

Publication date:

13/01/2026

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a potential use after free scenario. Improper resource management and reference counting on an internal resource caused scenario where potential write use after free was present.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2026

CVE-2025-58693

Publication date:

13/01/2026

An improper limitation of a pathname to a restricted directory (&#39;path traversal&#39;) vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2026

Subscribe to Vulnerabilities