Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-49150

Publication date:

11/06/2025

Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent can edit JSON files, this means a malicious agent, for example, after a prompt injection attack already succeeded, could trigger a GET request to an attacker controlled URL, potentially exfiltrating other data the agent may have access to. This vulnerability is fixed in 0.51.0.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-25032

Publication date:

11/06/2025

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an authenticated user to cause a denial of service by sending a specially crafted request that would exhaust memory resources.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2025

CVE-2025-40912

Publication date:

11/06/2025

CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode.<br /> <br /> CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-0913

Publication date:

11/06/2025

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2025

CVE-2025-0917

Publication date:

11/06/2025

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2025

CVE-2025-0923

Publication date:

11/06/2025

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source code on the web server that could aid in further attacks against the system.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2025

CVE-2025-6001

Publication date:

11/06/2025

A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasses the CSRF protection token. An attacker is able to craft a special CSRF request which will allow unrestricted file upload into the VirtueMart media manager.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-6002

Publication date:

11/06/2025

An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated attackers can upload files with arbitrary extensions, including executable or malicious files, potentially leading to remote code execution or other security impacts depending on server configuration.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-22874

Publication date:

11/06/2025

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-40915

Publication date:

11/06/2025

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens.<br /> <br /> That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand() function.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-4673

Publication date:

11/06/2025

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-1698

Publication date:

11/06/2025

Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker to cause a denial of service.

Severity CVSS v4.0: LOW

Last modification:

15/04/2026

Subscribe to Vulnerabilities