Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-27065

Publication date:
06/08/2025
Transient DOS while processing a frame with malformed shared-key descriptor.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2025

CVE-2025-27062

Publication date:
06/08/2025
Memory corruption while handling client exceptions, allowing unauthorized channel access.
Severity CVSS v4.0: Pending analysis
Last modification:
28/11/2025

CVE-2025-21457

Publication date:
06/08/2025
Information disclosure while opening a fastrpc session when domain is not sanitized.
Severity CVSS v4.0: Pending analysis
Last modification:
19/08/2025

CVE-2025-21458

Publication date:
06/08/2025
Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.
Severity CVSS v4.0: Pending analysis
Last modification:
19/08/2025

CVE-2025-21461

Publication date:
06/08/2025
Memory corruption when programming registers through virtual CDM.
Severity CVSS v4.0: Pending analysis
Last modification:
19/08/2025

CVE-2025-21464

Publication date:
06/08/2025
Information disclosure while reading data from an image using specified offset and size parameters.
Severity CVSS v4.0: Pending analysis
Last modification:
28/11/2025

CVE-2025-21465

Publication date:
06/08/2025
Information disclosure while processing the hash segment in an MBN file.
Severity CVSS v4.0: Pending analysis
Last modification:
28/11/2025

CVE-2025-21456

Publication date:
06/08/2025
Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2025

CVE-2025-21452

Publication date:
06/08/2025
Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2025

CVE-2025-21455

Publication date:
06/08/2025
Memory corruption while submitting blob data to kernel space though IOCTL.
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2025

CVE-2025-7376

Publication date:
06/08/2025
Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric IoTWorX version 10.95, Mitsubishi Electric GENESIS version 11.00, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions IoTWorX version 10.95, and Mitsubishi Electric Iconics Digital Solutions GENESIS version 11.00 allows a local authenticated attacker to make an unauthorized write to arbitrary files, by creating a symbolic link from a file used as a write destination by the processes of the affected products to a target file. This could allow the attacker to destroy the file on a PC with the affected products installed, resulting in a denial-of-service (DoS) condition on the PC if the destroyed file is necessary for the operation of the PC.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-7727

Publication date:
06/08/2025
The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026