Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-30349

Publication date:

21/03/2025

Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-29226

Publication date:

21/03/2025

In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"] parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

CVE-2025-29230

Publication date:

21/03/2025

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

CVE-2025-29223

Publication date:

21/03/2025

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

CVE-2025-29227

Publication date:

21/03/2025

In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize"] parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

CVE-2024-53350

Publication date:

21/03/2025

Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account&#39;s token, leading to escalation of privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

CVE-2024-53351

Publication date:

21/03/2025

Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account&#39;s token, leading to escalation of privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

CVE-2024-53349

Publication date:

21/03/2025

Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account&#39;s token, leading to escalation of privileges via the secretes component in the k8s cluster

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

CVE-2023-43029

Publication date:

21/03/2025

IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment.

Severity CVSS v4.0: CRITICAL

Last modification:

17/08/2025

CVE-2024-53348

Publication date:

21/03/2025

LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

CVE-2019-16151

Publication date:

21/03/2025

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim&#39;s browser context.<br /> This happens when the FortiGate has web filtering and category override enabled/configured.

Severity CVSS v4.0: Pending analysis

Last modification:

23/07/2025

CVE-2025-30157

Publication date:

21/03/2025

Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy&#39;s ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter&#39;s life time issue. A known situation is the failure of a websocket handshake will trigger a local reply leading to the crash of Envoy. This vulnerability is fixed in 1.33.1, 1.32.4, 1.31.6, and 1.30.10.

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2025

Subscribe to Vulnerabilities