Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-12285

Publication date:
26/10/2025
Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: CRITICAL
Last modification:
10/11/2025

CVE-2025-12284

Publication date:
26/10/2025
Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: MEDIUM
Last modification:
10/11/2025

CVE-2025-12278

Publication date:
26/10/2025
Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: MEDIUM
Last modification:
10/11/2025

CVE-2025-12275

Publication date:
26/10/2025
Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: CRITICAL
Last modification:
07/11/2025

CVE-2025-8709

Publication date:
26/10/2025
A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation. The affected version is langgraph-checkpoint-sqlite 2.0.10. The vulnerability arises from improper handling of filter operators ($eq, $ne, $gt, $lt, $gte, $lte) where direct string concatenation is used without proper parameterization. This allows attackers to inject arbitrary SQL, leading to unauthorized access to all documents, data exfiltration of sensitive fields such as passwords and API keys, and a complete bypass of application-level security filters.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-55757

Publication date:
25/10/2025
A unauthenticated reflected XSS vulnerability in VirtueMart 1.0.0-4.4.10 for Joomla was discovered.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-12221

Publication date:
25/10/2025
Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: LOW
Last modification:
07/11/2025

CVE-2025-12220

Publication date:
25/10/2025
Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: CRITICAL
Last modification:
10/11/2025

CVE-2025-12219

Publication date:
25/10/2025
Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: CRITICAL
Last modification:
10/11/2025

CVE-2025-12218

Publication date:
25/10/2025
Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: CRITICAL
Last modification:
10/11/2025

CVE-2025-12217

Publication date:
25/10/2025
SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: MEDIUM
Last modification:
10/11/2025

CVE-2025-12216

Publication date:
25/10/2025
Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
Severity CVSS v4.0: CRITICAL
Last modification:
10/11/2025