Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-12140
Publication date:
27/11/2025
The application contains an insecure &amp;#39;redirectToUrl&amp;#39; mechanism that incorrectly processes the value of the &amp;#39;redirectUrlParameter&amp;#39; parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution.<br /> This issue was fixed in version wu#2016.1.5513#0#20251014_113353
Severity CVSS v4.0: CRITICAL
Last modification:
27/11/2025

CVE-2025-12971
Publication date:
27/11/2025
The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the &amp;#39;wcp_change_post_folder&amp;#39; function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-54057
Publication date:
27/11/2025
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking.<br /> <br /> This issue affects Apache SkyWalking:
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-59302
Publication date:
27/11/2025
In Apache CloudStack improper control of generation of code (&amp;#39;Code Injection&amp;#39;) vulnerability is found in the following APIs which are accessible only to admins.<br /> <br /> * quotaTariffCreate<br /> * quotaTariffUpdate<br /> * createSecondaryStorageSelector<br /> * updateSecondaryStorageSelector<br /> * updateHost<br /> * updateStorage<br /> <br /> <br /> This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.<br /> <br /> The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-59454
Publication date:
27/11/2025
In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL<br /> - listNetworkACLs<br /> - listResourceDetails<br /> - listVirtualMachinesUsageHistory<br /> - listVolumesUsageHistory<br /> <br /> While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope.<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-59890
Publication date:
27/11/2025
Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-13742
Publication date:
27/11/2025
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer&amp;#39;s name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing.
Severity CVSS v4.0: LOW
Last modification:
27/11/2025

CVE-2025-10476
Publication date:
27/11/2025
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_db_fix_callback() function in all versions up to, and including, 1.4.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to initiate several database fix actions. This only affects sites with premium activated.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-59026
Publication date:
27/11/2025
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-13381
Publication date:
27/11/2025
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the &amp;#39;ays_chatgpt_save_wp_media&amp;#39; function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload media files.
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-30186
Publication date:
27/11/2025
Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025

CVE-2025-30190
Publication date:
27/11/2025
Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users account, including exfiltration of sensitive information. Please deploy the provided updates and patch releases. No publicly available exploits are known
Severity CVSS v4.0: Pending analysis
Last modification:
27/11/2025
Subscribe to Vulnerabilities