Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-48476

Publication date:

30/05/2025

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is no check for the absence of the password field in the data coming from the user, which leads to a mass-assignment vulnerability. As a result, a user with the right to edit other users of the system can change their password, and then log in to the system using the set password. This issue has been patched in version 1.8.180.

Severity CVSS v4.0: HIGH

Last modification:

04/06/2025

CVE-2025-48491

Publication date:

30/05/2025

Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been patched in the pre-beta version.

Severity CVSS v4.0: LOW

Last modification:

30/05/2025

CVE-2025-48381

Publication date:

30/05/2025

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tasks, projects, labels, and the IDs of all jobs and quality reports on the CVAT instance. In addition, if the instance contains many resources of a particular type, retrieving this information may tie up system resources, denying access to legitimate users. This issue has been patched in version 2.38.0.

Severity CVSS v4.0: MEDIUM

Last modification:

15/10/2025

CVE-2025-48068

Publication date:

30/05/2025

Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.

Severity CVSS v4.0: LOW

Last modification:

10/09/2025

CVE-2025-44905

Publication date:

30/05/2025

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2025

CVE-2025-44906

Publication date:

30/05/2025

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Severity CVSS v4.0: Pending analysis

Last modification:

19/06/2025

CVE-2025-47952

Publication date:

30/05/2025

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.25 and 3.4.1.

Severity CVSS v4.0: LOW

Last modification:

25/11/2025

CVE-2025-44904

Publication date:

30/05/2025

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2025

CVE-2025-44612

Publication date:

30/05/2025

Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing attackers to possibly intercept and access sensitive information via a man-in-the-middle attack.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2025

CVE-2025-44614

Publication date:

30/05/2025

Tinxy WiFi Lock Controller v1 RF was discovered to store users&#39; sensitive information, including credentials and mobile phone numbers, in plaintext.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2025

CVE-2025-44619

Publication date:

30/05/2025

Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

22/07/2025

CVE-2025-48757

Publication date:

30/05/2025

An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.

Severity CVSS v4.0: Pending analysis

Last modification:

21/08/2025

Subscribe to Vulnerabilities