Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-5241
Publication date:
11/07/2025
Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset.
Severity CVSS v4.0: Pending analysis
Last modification:
11/07/2025

CVE-2025-7420
Publication date:
11/07/2025
A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been declared as critical. This vulnerability affects the function formWifiBasicSet of the file /goform/setWrlBasicInfo of the component httpd. The manipulation of the argument extChannel leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-53509
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that allows for argument <br /> injection in the NetworkServlet.restoreDatabase(). This issue requires <br /> an authenticated attacker with at least user-level privileges. An input <br /> parameter can be used directly in a command without proper sanitization,<br /> allowing arbitrary arguments to be injected. This can result in <br /> information disclosure, including sensitive database credentials.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-53515
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that allows for SQL injection <br /> and remote code execution through NetworkServlet.archiveTrap(). This <br /> issue requires an authenticated attacker with at least user-level <br /> privileges. Certain input parameters are not sanitized, allowing an <br /> attacker to perform SQL injection and potentially execute code in the <br /> context of the &amp;#39;nt authority\local service&amp;#39; account.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-53519
Publication date:
11/07/2025
A vulnerability exists in Advantech iView versions prior to 5.7.05 build<br /> 7057, which could allow a reflected cross-site scripting (XSS) attack. <br /> By manipulating specific parameters, an attacker could execute <br /> unauthorized scripts in the user&amp;#39;s browser, potentially leading to <br /> information disclosure or other malicious activities.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-53475
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that could allow for SQL <br /> injection and remote code execution through <br /> NetworkServlet.getNextTrapPage(). This issue requires an authenticated <br /> attacker with at least user-level privileges. Certain parameters in this<br /> function are not properly sanitized, allowing an attacker to perform <br /> SQL injection and potentially execute code in the context of the &amp;#39;nt <br /> authority\local service&amp;#39; account.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-50109
Publication date:
11/07/2025
Emerson ValveLink Products store<br /> sensitive information in cleartext within a resource that might be accessible to another control sphere.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-52459
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that allows for argument <br /> injection in NetworkServlet.backupDatabase(). This issue requires an <br /> authenticated attacker with at least user-level privileges. Certain <br /> parameters can be used directly in a command without proper <br /> sanitization, allowing arbitrary arguments to be injected. This can <br /> result in information disclosure, including sensitive database <br /> credentials.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-52577
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that could allow SQL injection<br /> and remote code execution through NetworkServlet.archiveTrapRange(). <br /> This issue requires an authenticated attacker with at least user-level <br /> privileges. Certain input parameters are not properly sanitized, <br /> allowing an attacker to perform SQL injection and potentially execute <br /> code in the context of the &amp;#39;nt authority\local service&amp;#39; account.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-52579
Publication date:
11/07/2025
Emerson ValveLink Products store sensitive information in cleartext in memory. The <br /> sensitive memory might be saved to disk, stored in a core dump, or <br /> remain uncleared if the product crashes, or if the programmer does not <br /> properly clear the memory before freeing it.
Severity CVSS v4.0: CRITICAL
Last modification:
11/07/2025

CVE-2025-53397
Publication date:
11/07/2025
A vulnerability exists in Advantech iView versions prior to 5.7.05 build<br /> 7057, which could allow a reflected cross-site scripting (XSS) attack. <br /> By exploiting this flaw, an attacker could execute unauthorized scripts <br /> in the user&amp;#39;s browser, potentially leading to information disclosure or <br /> other malicious activities.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-53471
Publication date:
11/07/2025
Emerson ValveLink products <br /> receive input or data, but it do not validate or incorrectly <br /> validates that the input has the properties that are required to process<br /> the data safely and correctly.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025
Subscribe to Vulnerabilities