Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-50433

Publication date:

26/11/2025

An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts.

Severity CVSS v4.0: Pending analysis

Last modification:

29/12/2025

CVE-2025-65278

Publication date:

26/11/2025

An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive information including plaintext usernames and passwords.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2025

CVE-2025-65276

Publication date:

26/11/2025

An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 (2021-07-02). Due to missing authentication checks on /admin_index.php, an attacker can directly access the admin dashboard without valid credentials. This allows full administrative control including viewing/modifying user accounts, managing orders, changing payments, and editing product listings. Successful exploitation can lead to information disclosure, data manipulation, and privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2025

CVE-2025-12571

Publication date:

26/11/2025

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an unauthenticated user to cause a Denial of Service condition by sending specifically crafted requests containing malicious JSON payloads.

Severity CVSS v4.0: Pending analysis

Last modification:

10/12/2025

CVE-2025-66028

Publication date:

26/11/2025

OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, it is possible to gain access to the admin dashboard interface. However, an attacker may be unable to view or interact with the data if they still do not have sufficient permissions. This issue has been patched in version 8.0.5567.

Severity CVSS v4.0: MEDIUM

Last modification:

05/12/2025

CVE-2025-65966

Publication date:

26/11/2025

OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.

Severity CVSS v4.0: HIGH

Last modification:

05/12/2025

CVE-2025-65681

Publication date:

26/11/2025

An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.

Severity CVSS v4.0: Pending analysis

Last modification:

30/12/2025

CVE-2025-65675

Publication date:

26/11/2025

Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2025

CVE-2025-65676

Publication date:

26/11/2025

Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2025

CVE-2025-65672

Publication date:

26/11/2025

Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2025

CVE-2025-65669

Publication date:

26/11/2025

An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2025

CVE-2021-4472

Publication date:

26/11/2025

The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the &#39;Create Workbook&#39; feature that may result in disclosure of arbitrary local files content.

Severity CVSS v4.0: Pending analysis

Last modification:

01/12/2025

Subscribe to Vulnerabilities