Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-13182
Publication date:
13/02/2025
The WP Directorybox Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.5. This is due to incorrect authentication in the 'wp_dp_parse_request' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-21700
Publication date:
13/02/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: sched: Disallow replacing of child qdisc from one parent to another<br /> <br /> Lion Ackermann was able to create a UAF which can be abused for privilege<br /> escalation with the following script<br /> <br /> Step 1. create root qdisc<br /> tc qdisc add dev lo root handle 1:0 drr<br /> <br /> step2. a class for packet aggregation do demonstrate uaf<br /> tc class add dev lo classid 1:1 drr<br /> <br /> step3. a class for nesting<br /> tc class add dev lo classid 1:2 drr<br /> <br /> step4. a class to graft qdisc to<br /> tc class add dev lo classid 1:3 drr<br /> <br /> step5.<br /> tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024<br /> <br /> step6.<br /> tc qdisc add dev lo parent 1:2 handle 3:0 drr<br /> <br /> step7.<br /> tc class add dev lo classid 3:1 drr<br /> <br /> step 8.<br /> tc qdisc add dev lo parent 3:1 handle 4:0 pfifo<br /> <br /> step 9. Display the class/qdisc layout<br /> <br /> tc class ls dev lo<br /> class drr 1:1 root leaf 2: quantum 64Kb<br /> class drr 1:2 root leaf 3: quantum 64Kb<br /> class drr 3:1 root leaf 4: quantum 64Kb<br /> <br /> tc qdisc ls<br /> qdisc drr 1: dev lo root refcnt 2<br /> qdisc plug 2: dev lo parent 1:1<br /> qdisc pfifo 4: dev lo parent 3:1 limit 1000p<br /> qdisc drr 3: dev lo parent 1:2<br /> <br /> step10. trigger the bug
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-13606
Publication date:
13/02/2025
The JS Help Desk – The Ultimate Help Desk &amp; Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the &amp;#39;jssupportticketdata&amp;#39; directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.
Severity CVSS v4.0: Pending analysis
Last modification:
18/02/2025

CVE-2024-13867
Publication date:
13/02/2025
The Listivo - Classified Ads WordPress Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the &amp;#39;s&amp;#39; parameter in all versions up to, and including, 2.3.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity CVSS v4.0: Pending analysis
Last modification:
18/02/2025

CVE-2024-3303
Publication date:
13/02/2025
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.
Severity CVSS v4.0: Pending analysis
Last modification:
06/08/2025

CVE-2024-46910
Publication date:
13/02/2025
An authenticated user can perform XSS and potentially impersonate another user.<br /> <br /> This issue affects Apache Atlas versions 2.3.0 and earlier.<br /> <br /> Users are recommended to upgrade to version 2.4.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
14/07/2025

CVE-2024-13639
Publication date:
13/02/2025
The Read More &amp; Accordion plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the expmDeleteData() function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary &amp;#39;read more&amp;#39; posts.
Severity CVSS v4.0: Pending analysis
Last modification:
18/02/2025

CVE-2025-0815
Publication date:
13/02/2025
CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the<br /> product when malicious ICMPV6 packets are sent to the device.
Severity CVSS v4.0: HIGH
Last modification:
15/04/2026

CVE-2025-0816
Publication date:
13/02/2025
CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the<br /> product when malicious IPV6 packets are sent to the device.
Severity CVSS v4.0: HIGH
Last modification:
15/04/2026

CVE-2024-47265
Publication date:
13/02/2025
Improper limitation of a pathname to a restricted directory (&amp;#39;Path Traversal&amp;#39;) vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users to write specific files via unspecified vectors.
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2026

CVE-2024-47266
Publication date:
13/02/2025
Improper limitation of a pathname to a restricted directory (&amp;#39;Path Traversal&amp;#39;) vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to read specific files containing non-sensitive information via unspecified vectors.
Severity CVSS v4.0: Pending analysis
Last modification:
26/02/2026

CVE-2025-0327
Publication date:
13/02/2025
CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit<br /> trail data and the other acting as server managing client request) that could cause a loss of Confidentiality,<br /> Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the<br /> executable path of the windows services. To be exploited, services need to be restarted.
Severity CVSS v4.0: HIGH
Last modification:
15/04/2026
Subscribe to Vulnerabilities