Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-46626

Publication date:

01/05/2025

Reuse of a static AES key and initialization vector for encrypted traffic to the &#39;ate&#39; management service of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt, replay, and/or forge traffic to the service.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46627

Publication date:

01/05/2025

Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root password based on easily-obtained device information. The password is based on the last two digits/octets of the MAC address.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46628

Publication date:

01/05/2025

Lack of input validation/sanitization in the &#39;ate&#39; management service in the Tenda RX2 Pro 16.03.30.14 allows an unauthorized remote attacker to gain root shell access to the device by sending a crafted UDP packet to the &#39;ate&#39; service when it is enabled. Authentication is not needed.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46629

Publication date:

01/05/2025

Lack of access controls in the &#39;ate&#39; management binary of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to perform unauthorized configuration changes for any router where &#39;ate&#39; has been enabled by sending a crafted UDP packet

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46630

Publication date:

01/05/2025

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable &#39;ate&#39; (a remote system management binary) by sending a /goform/ate web request.

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2025-46569

Publication date:

01/05/2025

Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA’s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.

Severity CVSS v4.0: HIGH

Last modification:

02/05/2025

CVE-2025-29763

Publication date:

01/05/2025

Rejected reason: “This CVE ID is Rejected and will not be used. The issue was determined to not be a vulnerability.”

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2025-4174

Publication date:

01/05/2025

A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

09/05/2025

CVE-2025-35996

Publication date:

01/05/2025

KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later transmitted to the client in order to show a list of configuration files. Due to a missing escape or sanitization, the filename could be executed as HTML script tag resulting in a cross-site-scripting attack.

Severity CVSS v4.0: HIGH

Last modification:

02/05/2025

CVE-2025-36521

Publication date:

01/05/2025

MicroDicom DICOM Viewer is vulnerable to an out-of-bounds read which may allow an attacker to cause memory corruption within the application. The user must open a malicious DCM file for exploitation.

Severity CVSS v4.0: HIGH

Last modification:

02/05/2025

CVE-2025-36558

Publication date:

01/05/2025

KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory URL containing an HTML script as an sso_token, that script will reply to the user and be executed.

Severity CVSS v4.0: MEDIUM

Last modification:

02/05/2025

CVE-2025-3517

Publication date:

01/05/2025

Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2025

Subscribe to Vulnerabilities