Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-70968

Publication date:

14/01/2026

FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().

Severity CVSS v4.0: Pending analysis

Last modification:

23/01/2026

CVE-2025-37185

Publication date:

14/01/2026

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attacks against an administrative user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim&#39;s browser in the context of the affected interface and thereby make unauthorized arbitrary configuration changes to the host.

Severity CVSS v4.0: Pending analysis

Last modification:

20/01/2026

CVE-2025-37184

Publication date:

14/01/2026

A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Successful exploitation could allow an attacker to create an admin user account without the necessary multi-factor authentication, thereby compromising the integrity of secured access to the system.

Severity CVSS v4.0: Pending analysis

Last modification:

20/01/2026

CVE-2025-37183

Publication date:

14/01/2026

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading to unauthorized data access or data manipulation.

Severity CVSS v4.0: Pending analysis

Last modification:

20/01/2026

CVE-2025-37182

Publication date:

14/01/2026

Severity CVSS v4.0: Pending analysis

Last modification:

20/01/2026

CVE-2025-65396

Publication date:

14/01/2026

A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootloader shell via the UART interface. This is achieved by inducing a read error from the SPI flash memory during the boot, by shorting a data pin of the IC to ground. An attacker can then dump the entire firmware, leading to the disclosure of sensitive information including cryptographic keys and user configurations.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2026

CVE-2025-37181

Publication date:

14/01/2026

Severity CVSS v4.0: Pending analysis

Last modification:

20/01/2026

CVE-2026-22211

Publication date:

14/01/2026

TinyOS versions up to and including 2.1.2 contain a global buffer overflow vulnerability in the printfUART formatted output implementation used within the ZigBee / IEEE 802.15.4 networking stack. The implementation formats output into a fixed-size global buffer and concatenates strings for %s format specifiers using strcat() without verifying remaining buffer capacity. When printfUART is invoked with a caller-controlled string longer than the available space, the unbounded sprintf/strcat sequence writes past the end of debugbuf, resulting in global memory corruption. This can cause denial of service, unintended behavior, or information disclosure via corrupted adjacent global state or UART output.

Severity CVSS v4.0: MEDIUM

Last modification:

14/01/2026

CVE-2025-67399

Publication date:

14/01/2026

An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller (Wi-Fi and BLE module) on the device is open to access

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2026

CVE-2025-14242

Publication date:

14/01/2026

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2026

CVE-2026-22820

Publication date:

14/01/2026

Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.

Severity CVSS v4.0: MEDIUM

Last modification:

20/01/2026

CVE-2026-22240

Publication date:

14/01/2026

The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers&#39; data and completely compromise the targeted platform by logging in using an exposed admin email address and password.

Severity CVSS v4.0: CRITICAL

Last modification:

02/02/2026

Subscribe to Vulnerabilities