Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-65516

Publication date:

04/12/2025

A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim&#39;s browser. This issue has been fixed in Seafile Community Edition 13.0.12.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2025

CVE-2025-61148

Publication date:

04/12/2025

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the &#39;rec_no&#39; parameter in the /student/get-receipt endpoint.

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2025

CVE-2025-54159

Publication date:

04/12/2025

Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2026

CVE-2025-54160

Publication date:

04/12/2025

Improper limitation of a pathname to a restricted directory (&#39;Path Traversal&#39;) vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2026

CVE-2025-57210

Publication date:

04/12/2025

Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2025

CVE-2025-57212

Publication date:

04/12/2025

Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2025

CVE-2025-57213

Publication date:

04/12/2025

Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2025

CVE-2025-56427

Publication date:

04/12/2025

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function.

Severity CVSS v4.0: Pending analysis

Last modification:

16/12/2025

CVE-2025-54158

Publication date:

04/12/2025

Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

24/02/2026

CVE-2025-40262

Publication date:

04/12/2025

In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we accidentally pass "&priv" which is an address in the stack and so it will lead to memory corruption when the imx_sc_key_action() function is called. Remove the &.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-40263

Publication date:

04/12/2025

In the Linux kernel, the following vulnerability has been resolved: Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn&#39;t called (due to `buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains NULL. An invalid memory access is observed in cros_ec_keyb_process() when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work() in such case. Unable to handle kernel read from unreadable memory at virtual address 0000000000000028 ... x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: input_event cros_ec_keyb_work blocking_notifier_call_chain ec_irq_thread It&#39;s still unknown about why the kernel receives such malformed event, in any cases, the kernel shouldn&#39;t access `ckdev->idev` and friends if the driver doesn&#39;t intend to initialize them.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-40264

Publication date:

04/12/2025

In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL pointer when processing a workaround for specific packet, as commit bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6 packet") states. The correct way would be to pass the wrb_params from be_xmit().

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

Subscribe to Vulnerabilities