Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-5903

Publication date:

10/06/2025

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: HIGH

Last modification:

16/06/2025

CVE-2025-5904

Publication date:

10/06/2025

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument device_name leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: HIGH

Last modification:

16/06/2025

CVE-2025-5905

Publication date:

10/06/2025

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been rated as critical. Affected by this issue is the function setWiFiRepeaterCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument Password leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: HIGH

Last modification:

16/06/2025

CVE-2025-0037

Publication date:

10/06/2025

In AMD Versal Adaptive SoC devices, the lack of address validation when executing PLM runtime services through the PLM firmware can allow access to isolated or protected memory spaces, resulting in the loss of integrity and confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-0036

Publication date:

10/06/2025

In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrectly written to and read from invalid locations as well as returning incorrect cryptographic data.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-30507

Publication date:

09/06/2025

CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections.

Severity CVSS v4.0: MEDIUM

Last modification:

12/08/2025

CVE-2025-30515

Publication date:

09/06/2025

CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.

Severity CVSS v4.0: CRITICAL

Last modification:

12/08/2025

CVE-2025-5901

Publication date:

09/06/2025

A vulnerability has been found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: HIGH

Last modification:

16/06/2025

CVE-2025-5902

Publication date:

09/06/2025

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument slaveIpList leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: HIGH

Last modification:

16/06/2025

CVE-2025-26468

Publication date:

09/06/2025

CyberData 011209 Intercom exposes features that could allow an unauthenticated to gain access and cause a denial-of-service condition or system disruption.

Severity CVSS v4.0: HIGH

Last modification:

20/06/2025

CVE-2025-30183

Publication date:

09/06/2025

CyberData 011209 Intercom does not properly store or protect web server admin credentials.

Severity CVSS v4.0: HIGH

Last modification:

12/08/2025

CVE-2025-5900

Publication date:

09/06/2025

A vulnerability, which was classified as problematic, was found in Tenda AC9 15.03.02.13. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

16/06/2025

Subscribe to Vulnerabilities