Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-36631

Publication date:
13/06/2025
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
Severity CVSS v4.0: Pending analysis
Last modification:
23/10/2025

CVE-2025-28389

Publication date:
13/06/2025
Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2025

CVE-2025-28380

Publication date:
13/06/2025
A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
27/10/2025

CVE-2025-28381

Publication date:
13/06/2025
A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.
Severity CVSS v4.0: Pending analysis
Last modification:
27/10/2025

CVE-2025-28382

Publication date:
13/06/2025
An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
Severity CVSS v4.0: Pending analysis
Last modification:
27/10/2025

CVE-2025-28384

Publication date:
13/06/2025
An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.
Severity CVSS v4.0: Pending analysis
Last modification:
27/10/2025

CVE-2025-28388

Publication date:
13/06/2025
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
Severity CVSS v4.0: Pending analysis
Last modification:
27/10/2025

CVE-2025-28386

Publication date:
13/06/2025
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.
Severity CVSS v4.0: Pending analysis
Last modification:
23/06/2025

CVE-2025-46060

Publication date:
13/06/2025
Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component
Severity CVSS v4.0: Pending analysis
Last modification:
16/06/2025

CVE-2025-46096

Publication date:
13/06/2025
Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component
Severity CVSS v4.0: Pending analysis
Last modification:
23/06/2025

CVE-2025-45985

Publication date:
13/06/2025
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bs_SetSSIDHide function.
Severity CVSS v4.0: Pending analysis
Last modification:
10/07/2025

CVE-2025-45986

Publication date:
13/06/2025
Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bs_SetMacBlack function.
Severity CVSS v4.0: Pending analysis
Last modification:
23/07/2025