Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-27804

Publication date:

21/05/2025

Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2025-3781

Publication date:

21/05/2025

The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s raisely_donation_form shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2025-1415

Publication date:

21/05/2025

A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416.<br /> <br /> In order to perform the attack, one has to know a task_id, but since it&#39;s a low integer and there is no limit of requests an attacker can perform to a vulnerable endpoint, the task_id might be simply brute forced.<br /> <br /> This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

Severity CVSS v4.0: MEDIUM

Last modification:

21/05/2025

CVE-2024-12561

Publication date:

21/05/2025

The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This is due to insufficient validation on the redirect url supplied via the &#39;afflink&#39; parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2025-1712

Publication date:

21/05/2025

Argument injection in special agent configuration in Checkmk

Severity CVSS v4.0: HIGH

Last modification:

22/08/2025

CVE-2019-16536

Publication date:

21/05/2025

Stack overflow leading to DoS can be triggered by a malicious authenticated client in Clickhouse before 19.14.3.3.

Severity CVSS v4.0: HIGH

Last modification:

25/06/2025

CVE-2025-4524

Publication date:

21/05/2025

The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the &#39;template&#39; parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Severity CVSS v4.0: Pending analysis

Last modification:

21/05/2025

CVE-2025-4949

Publication date:

21/05/2025

In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.

Severity CVSS v4.0: MEDIUM

Last modification:

05/01/2026

CVE-2021-25255

Publication date:

21/05/2025

Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service.

Severity CVSS v4.0: HIGH

Last modification:

10/06/2025

CVE-2021-25262

Publication date:

21/05/2025

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

Severity CVSS v4.0: MEDIUM

Last modification:

10/06/2025

CVE-2021-25254

Publication date:

21/05/2025

Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.

Severity CVSS v4.0: HIGH

Last modification:

10/06/2025

CVE-2025-5013

Publication date:

21/05/2025

A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

17/06/2025

Subscribe to Vulnerabilities