Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-61673

Publication date:

03/10/2025

Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is skipped entirely, allowing an unauthenticated user to read and write to Schema Registry endpoints that should otherwise be protected. This effectively renders the OAuth authentication mechanism ineffective. This issue is fixed in version 5.0.2.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-61677

Publication date:

03/10/2025

DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-61679

Publication date:

03/10/2025

Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-61680

Publication date:

03/10/2025

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code&#39;s configuration API which writes to settings.json in plaintext. This issue is fixed in version 2.1.0.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2025-61681

Publication date:

03/10/2025

KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exploited for stored XSS. The upload endpoint only validates file types based on Content-Type headers, lacks file content analysis and extension whitelist restrictions, allowing attackers to upload SVG files containing malicious scripts (disguised as images). When users access the uploaded resource pages, arbitrary JavaScript executes in their browsers. This issue is fixed in version 1.3.14.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-43825

Publication date:

03/10/2025

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 allows sensitive user data to be included in the Freemarker template. This weakness permits an unauthorized actor to gain access to, and potentially render, confidential information that should remain restricted.

Severity CVSS v4.0: MEDIUM

Last modification:

15/12/2025

CVE-2025-61585

Publication date:

03/10/2025

Rejected reason: Further research determined the issue is not an independent vulnerability as it originates from Apache Felix.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2025

CVE-2025-59943

Publication date:

03/10/2025

phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multiple distinct accounts to be created with the same email. Because email is often used as an identifier for password resets, notifications, and administrative actions, this flaw can cause account ambiguity and, in certain configurations, may lead to privilege escalation or account takeover. This issue is fixed in version 4.0.13.

Severity CVSS v4.0: Pending analysis

Last modification:

10/10/2025

CVE-2025-59944

Publication date:

03/10/2025

Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protects its sensitive files (e.g., */.cursor/mcp.json), which allows attackers to modify the content of these files through prompt injection and achieve remote code execution. A prompt injection can lead to full RCE through modifying sensitive files on case-insensitive fileystems. This issue is fixed in version 1.7.

Severity CVSS v4.0: Pending analysis

Last modification:

16/10/2025

CVE-2025-10696

Publication date:

03/10/2025

OpenSupports exposes an endpoint that allows the list of &#39;supervised users&#39; for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party (the target user), who can then view the tickets of the added &#39;supervised&#39; users. This breaks the authorization model and filters the content of other users&#39; tickets.This issue affects OpenSupports: 4.11.0.

Severity CVSS v4.0: HIGH

Last modification:

22/12/2025

CVE-2025-10695

Publication date:

03/10/2025

Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied destination. Both endpoints are exposed with permission => &#39;any&#39;, enabling unauthenticated SSRF for internal network scanning and service interaction.<br /> <br /> This issue affects OpenSupports: 4.11.0.

Severity CVSS v4.0: MEDIUM

Last modification:

22/12/2025

CVE-2025-10692

Publication date:

03/10/2025

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user (level ≥ 1) can inject SQL to alter the filter logic, effectively bypassing department scoping and disclosing tickets beyond their intended access.This issue affects OpenSupports: 4.11.0.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

Subscribe to Vulnerabilities