Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-25844

Publication date:

07/02/2026

Rejected reason: Not used

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2026

CVE-2025-31990

Publication date:

07/02/2026

Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the system with a large number of requests, overwhelming its resources and causing it to become unresponsive to legitimate users. This vulnerability is fixed in 5.1.7.

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2026

CVE-2026-2071

Publication date:

07/02/2026

A vulnerability was found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formP2PLimitConfig. Performing a manipulation of the argument except results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37166

Publication date:

07/02/2026

AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attackers to crash the application. Attackers can overwrite the username field with a 1000-byte buffer, causing the application to become unresponsive and terminate.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37170

Publication date:

07/02/2026

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy address configuration that allows local attackers to crash the application. Attackers can overwrite the address field with 3000 bytes of arbitrary data to trigger an application crash and prevent normal program functionality.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37171

Publication date:

07/02/2026

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy username configuration that allows local attackers to crash the application. Attackers can overwrite the username field with 10,000 bytes of arbitrary data to trigger an application crash and prevent normal program functionality.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37160

Publication date:

07/02/2026

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder permissions on Windows systems. Local unprivileged users can exploit missing executable files and weak service configurations to create a new administrative user and gain complete system access.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37161

Publication date:

07/02/2026

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the registration name field with malicious payload. Attackers can craft a specially designed payload to trigger remote code execution, demonstrating the ability to run system commands like launching the calculator.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37162

Publication date:

07/02/2026

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload of 1608 bytes to trigger a stack-based buffer overflow and execute commands through the registration key field.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37163

Publication date:

07/02/2026

QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the &#39;_located&#39; parameter in the find_matches endpoint. Attackers can inject UNION-based SQL statements to extract database information including user credentials, database name, and system version.

Severity CVSS v4.0: HIGH

Last modification:

07/02/2026

CVE-2020-37164

Publication date:

07/02/2026

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license entry field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

CVE-2020-37165

Publication date:

07/02/2026

Severity CVSS v4.0: MEDIUM

Last modification:

07/02/2026

Subscribe to Vulnerabilities