Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-9158

Publication date:
24/10/2025
The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. XSS vulnerability allows an attacker to send a specifically crafted e-mail enabling JavaScript code execution by displaying the ticket in the context of the logged-in user. <br /> <br /> This vulnerability affects versions from 5.0.4 through 5.0.8 and from 6.0.0 through 6.0.1.
Severity CVSS v4.0: MEDIUM
Last modification:
27/10/2025

CVE-2025-10874

Publication date:
24/10/2025
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts &amp; More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.
Severity CVSS v4.0: Pending analysis
Last modification:
09/01/2026

CVE-2025-10723

Publication date:
24/10/2025
The PixelYourSite WordPress plugin before 11.1.2 does not validate some URL parameters before using them to generate paths passed to function/s, allowing any admins to perform LFI attacks
Severity CVSS v4.0: Pending analysis
Last modification:
09/01/2026

CVE-2025-62828

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2025-62829

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2025-62830

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2025-62831

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2025-62832

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2025-62833

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2025-62834

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2025-62835

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2025-62827

Publication date:
24/10/2025
Rejected reason: Not used
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025