Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-59491

Publication date:

12/11/2025

Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2025

CVE-2025-2843

Publication date:

12/11/2025

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create a MonitorStack in the authorized namespace and then elevate permission to the cluster level by impersonating the ServiceAccount created by the Operator, resulting in privilege escalation and other issues.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2025

CVE-2025-52331

Publication date:

12/11/2025

Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, which allows potentially malicious HTML tags to be injected into the report. User interaction is required. User must use the "generate report" functionality and open the report.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2025

CVE-2025-13042

Publication date:

12/11/2025

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2025-11797

Publication date:

12/11/2025

A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2025

CVE-2025-11795

Publication date:

12/11/2025

A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2025

CVE-2025-64293

Publication date:

12/11/2025

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Golemiq 0 Day Analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through 4.0.0.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-9316

Publication date:

12/11/2025

N-central

Severity CVSS v4.0: MEDIUM

Last modification:

12/11/2025

CVE-2025-64281

Publication date:

12/11/2025

An Authentication Bypass issue in CentralSquare Community Development 19.5.7 allows attackers to access the admin panel without admin credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2025

CVE-2025-64280

Publication date:

12/11/2025

A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2025

CVE-2025-63353

Publication date:

12/11/2025

A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device&#39;s factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction.

Severity CVSS v4.0: Pending analysis

Last modification:

31/12/2025

CVE-2025-63289

Publication date:

12/11/2025

Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file

Severity CVSS v4.0: Pending analysis

Last modification:

05/01/2026

Subscribe to Vulnerabilities