Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-45385

Publication date:

14/01/2025

A vulnerability has been identified in Industrial Edge Management OS (IEM-OS) (All versions). Affected components are vulnerable to reflected cross-site scripting (XSS) attacks. This could allow an attacker to extract sensitive information by tricking users into accessing a malicious link.

Severity CVSS v4.0: LOW

Last modification:

03/10/2025

CVE-2024-12919

Publication date:

14/01/2025

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pms_pb_payment_redirect_link function using the user-controlled value supplied via the &#39;pms_payment_id&#39; parameter to authenticate users without any further identity validation. This makes it possible for unauthenticated attackers with knowledge of a valid payment ID to log in as any user who has made a purchase on the targeted site.

Severity CVSS v4.0: Pending analysis

Last modification:

22/01/2025

CVE-2025-20016

Publication date:

14/01/2025

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y&#39;S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-20055

Publication date:

14/01/2025

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y&#39;S corporation. An attacker who can access the affected product may execute an arbitrary OS command.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-20620

Publication date:

14/01/2025

SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y&#39;S corporation. An attacker who can access the affected product may obtain the administrative password of the web management page.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-0393

Publication date:

14/01/2025

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wpr_filter_grid_posts() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

03/03/2025

CVE-2025-0394

Publication date:

14/01/2025

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gh_big_file_upload() function in all versions up to, and including, 3.7.3.5. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-11736

Publication date:

14/01/2025

A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-13156

Publication date:

14/01/2025

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘heading’ parameter in all versions up to, and including, 2.5.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-11734

Publication date:

14/01/2025

A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that has already been terminated, leading to the failure of said request.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-12365

Publication date:

14/01/2025

The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin&#39;s nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications.

Severity CVSS v4.0: Pending analysis

Last modification:

16/01/2025

CVE-2024-12006

Publication date:

14/01/2025

The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to deactivate the plugin as well as activate and deactivate plugin extensions.

Severity CVSS v4.0: Pending analysis

Last modification:

16/01/2025

Subscribe to Vulnerabilities