Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-10905

Publication date:

11/11/2025

Collision in MiniFilter driver in Avast Software Avast Free Antivirus before 25.9 on Windows allows a local attacker with administrative privileges to disable real-time protection and self-defense mechanisms.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-11959

Publication date:

11/11/2025

Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information Technologies Inc. Excavation Management Information System allows Footprinting, Functionality Misuse.This issue affects Excavation Management Information System: before v.10.2025.01.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2024-57695

Publication date:

11/11/2025

An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock function. The manufacturer fixed the vulnerability in version 8.0 (4164.652.1856) from December 17, 2012.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-12101

Publication date:

11/11/2025

Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Severity CVSS v4.0: MEDIUM

Last modification:

12/11/2025

CVE-2025-9223

Publication date:

11/11/2025

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-9227

Publication date:

11/11/2025

Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-11084

Publication date:

11/11/2025

A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day period.

Severity CVSS v4.0: HIGH

Last modification:

12/11/2025

CVE-2025-11085

Publication date:

11/11/2025

A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the execution of malicious JavaScript, allowing for account takeover, credential theft, or redirection to a malicious website.

Severity CVSS v4.0: HIGH

Last modification:

12/11/2025

CVE-2025-11696

Publication date:

11/11/2025

A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to trigger outbound SMB requests, enabling the capture of NTLM hashes.

Severity CVSS v4.0: HIGH

Last modification:

12/11/2025

CVE-2025-11697

Publication date:

11/11/2025

A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to extract files using path traversal sequences, resulting in execution of scripts with Administrator privileges on system reboot.

Severity CVSS v4.0: HIGH

Last modification:

12/11/2025

CVE-2025-11862

Publication date:

11/11/2025

A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete users via the API.

Severity CVSS v4.0: HIGH

Last modification:

12/11/2025

CVE-2025-41106

Publication date:

11/11/2025

HTML injection vulnerability found in Fairsketch&#39;s RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter &#39;first_name&#39; in &#39;/clients/save_contact/&#39;.

Severity CVSS v4.0: MEDIUM

Last modification:

12/11/2025

Subscribe to Vulnerabilities