Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-40116
Publication date:
12/11/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup<br /> <br /> The kthread_run() function returns error pointers so the<br /> max3421_hcd-&gt;spi_thread pointer can be either error pointers or NULL.<br /> Check for both before dereferencing it.
Severity CVSS v4.0: Pending analysis
Last modification:
12/11/2025

CVE-2025-11454
Publication date:
12/11/2025
The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplicate_post_as_draft() function in all versions up to, and including, 0.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with COntributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Severity CVSS v4.0: Pending analysis
Last modification:
12/11/2025

CVE-2025-64407
Publication date:
12/11/2025
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links <br /> to be loaded without prompt. Such links could also be used to transmit system information, such as environment variables or configuration settings.<br /> <br /> In the affected versions of Apache OpenOffice, documents that used a certain URI scheme linking to external files would <br /> load the contents of such files without prompting the user for <br /> permission to do so. Such URI scheme allows to include system configuration data, that is not supposed to be transmitted externally.<br /> <br /> This issue affects Apache OpenOffice: through 4.1.15.<br /> <br /> Users are recommended to upgrade to version 4.1.16, which fixes the issue.<br /> <br /> <br /> <br /> <br /> <br /> The LibreOffice suite reported this issue as CVE-2024-12426.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2025

CVE-2025-37734
Publication date:
12/11/2025
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.
Severity CVSS v4.0: Pending analysis
Last modification:
12/11/2025

CVE-2025-12382
Publication date:
12/11/2025
Improper Limitation of a Pathname &amp;#39;Path Traversal&amp;#39;) vulnerability in Algosec Firewall Analyzer on Linux, 64 bit allows an authenticated user to upload files to a restricted directory leading to code injection. This issue affects Algosec Firewall Analyzer: A33.0 (up to build 320), A33.10 (up to build 210).
Severity CVSS v4.0: HIGH
Last modification:
13/11/2025

CVE-2025-61623
Publication date:
12/11/2025
Reflected cross-site scripting vulnerability in Apache OFBiz.<br /> <br /> This issue affects Apache OFBiz: before 24.09.03.<br /> <br /> Users are recommended to upgrade to version 24.09.03, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2025

CVE-2025-59118
Publication date:
12/11/2025
Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz.<br /> <br /> This issue affects Apache OFBiz: before 24.09.03.<br /> <br /> Users are recommended to upgrade to version 24.09.03, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2025

CVE-2025-11962
Publication date:
12/11/2025
Improper Neutralization of Input During Web Page Generation (XSS or &amp;#39;Cross-site Scripting&amp;#39;) vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS.This issue affects Digital Corporate Warehouse: before v.4.8.2.22.
Severity CVSS v4.0: Pending analysis
Last modification:
12/11/2025

CVE-2025-64404
Publication date:
12/11/2025
Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links <br /> to be loaded without prompt. In the affected versions of Apache OpenOffice, documents that used background fill images, or bullet images, linked to external files would <br /> load the contents of those files without prompting the user for <br /> permission to do so.<br /> <br /> This issue affects Apache OpenOffice: through 4.1.15.<br /> <br /> Users are recommended to upgrade to version 4.1.16, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2025

CVE-2025-64405
Publication date:
12/11/2025
Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links <br /> to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to external files would <br /> load the contents of those files without prompting the user for <br /> permission to do so.<br /> <br /> This issue affects Apache OpenOffice: through 4.1.15.<br /> <br /> Users are recommended to upgrade to version 4.1.16, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2025

CVE-2025-64406
Publication date:
12/11/2025
An out-of-bounds Write vulnerability in Apache OpenOffice could allow an attacker to craft a document that would crash the program, or otherwise corrupt other memory areas.<br /> <br /> This issue affects Apache OpenOffice: through 4.1.15.<br /> <br /> Users are recommended to upgrade to version 4.1.16, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2025

CVE-2025-64403
Publication date:
12/11/2025
Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause such links <br /> to be loaded without prompt.<br /> <br /> This issue affects Apache OpenOffice: through 4.1.15.<br /> <br /> Users are recommended to upgrade to version 4.1.16, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
13/11/2025
Subscribe to Vulnerabilities