Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-34283

Publication date:

30/10/2025

Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user&#39;s or their own API key value.

Severity CVSS v4.0: HIGH

Last modification:

06/11/2025

CVE-2025-34280

Publication date:

30/10/2025

Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web application service, resulting in remote code execution with the service&#39;s privileges.

Severity CVSS v4.0: HIGH

Last modification:

06/11/2025

CVE-2025-34278

Publication date:

30/10/2025

Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affected page the injected script executes in the victim&#39;s browser context.

Severity CVSS v4.0: MEDIUM

Last modification:

06/11/2025

CVE-2025-34273

Publication date:

30/10/2025

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards that affect other users or the overall monitoring UI.

Severity CVSS v4.0: HIGH

Last modification:

06/11/2025

CVE-2025-34272

Publication date:

30/10/2025

In Nagios Log Server versions prior to 2024R2.0.3, when a user&#39;s configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user&#39;s default view. Depending on the product&#39;s dashboard sharing and access policies, this behavior may cause information exposure or unexpected privilege exposure.

Severity CVSS v4.0: MEDIUM

Last modification:

06/11/2025

CVE-2025-34271

Publication date:

30/10/2025

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.

Severity CVSS v4.0: HIGH

Last modification:

06/11/2025

CVE-2025-34270

Publication date:

30/10/2025

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.

Severity CVSS v4.0: MEDIUM

Last modification:

06/11/2025

CVE-2025-34135

Publication date:

30/10/2025

Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.

Severity CVSS v4.0: MEDIUM

Last modification:

06/11/2025

CVE-2025-34249

Publication date:

30/10/2025

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425.

Severity CVSS v4.0: CRITICAL

Last modification:

07/11/2025

CVE-2025-34269

Publication date:

30/10/2025

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60424.

Severity CVSS v4.0: HIGH

Last modification:

07/11/2025

CVE-2024-58273

Publication date:

30/10/2025

Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user (or the backend shell user) to escalate to root on the host.

Severity CVSS v4.0: HIGH

Last modification:

06/11/2025

CVE-2024-14006

Publication date:

30/10/2025

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.

Severity CVSS v4.0: HIGH

Last modification:

06/11/2025

Subscribe to Vulnerabilities