Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-31919

Publication date:
17/06/2025
Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2025

CVE-2025-24761

Publication date:
17/06/2025
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK allows PHP Local File Inclusion. This issue affects DSK: from n/a through 2.2.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2025

CVE-2025-24773

Publication date:
17/06/2025
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPCRM - CRM for Contact form CF7 & WooCommerce allows SQL Injection. This issue affects WPCRM - CRM for Contact form CF7 & WooCommerce: from n/a through 3.2.0.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2025

CVE-2025-4879

Publication date:
17/06/2025
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Workspace app for Windows
Severity CVSS v4.0: HIGH
Last modification:
17/06/2025

CVE-2025-6069

Publication date:
17/06/2025
The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.
Severity CVSS v4.0: Pending analysis
Last modification:
07/07/2025

CVE-2025-4404

Publication date:
17/06/2025
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2025

CVE-2025-49842

Publication date:
17/06/2025
conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. Prior to version 2025.3.24, the conda_forge_webservice Docker container executes commands without specifying a user. By default, Docker containers run as the root user, which increases the risk of privilege escalation and host compromise if a vulnerability is exploited. This issue has been patched in version 2025.3.24.
Severity CVSS v4.0: LOW
Last modification:
17/06/2025

CVE-2025-0320

Publication date:
17/06/2025
Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Citrix Secure Access Client for Windows
Severity CVSS v4.0: HIGH
Last modification:
17/06/2025

CVE-2025-5349

Publication date:
17/06/2025
Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway
Severity CVSS v4.0: HIGH
Last modification:
17/06/2025

CVE-2025-6020

Publication date:
17/06/2025
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
Severity CVSS v4.0: Pending analysis
Last modification:
10/07/2025

CVE-2025-5777

Publication date:
17/06/2025
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Severity CVSS v4.0: CRITICAL
Last modification:
10/07/2025

CVE-2025-4365

Publication date:
17/06/2025
Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)
Severity CVSS v4.0: MEDIUM
Last modification:
17/06/2025