Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-43701

Publication date:

10/06/2025

Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: before version 254.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-2918

Publication date:

10/06/2025

The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

14/07/2025

CVE-2025-41657

Publication date:

10/06/2025

Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated adjacent attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-13089

Publication date:

10/06/2025

An OS command injection vulnerability within the update functionality may allow an authenticated administrator to execute unauthorized arbitrary OS commands. Users with administrative privileges may upload update packages to upgrade the versions of Nozomi Networks Guardian and CMC. While these updates are signed and their signatures are validated prior to installation, an improper signature validation check has been identified. This issue could potentially enable users to execute commands remotely on the appliance, thereby impacting confidentiality, integrity, and availability.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2024-13090

Publication date:

10/06/2025

A privilege escalation vulnerability may enable a service account to elevate its privileges. The sudo rules configured for a local service account were excessively permissive, potentially allowing administrative access if a malicious actor could execute arbitrary commands as that account. It is important to note that no such vector has been identified in this instance.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2025-40662

Publication date:

10/06/2025

Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a non-existent file.

Severity CVSS v4.0: MEDIUM

Last modification:

22/10/2025

CVE-2025-40657

Publication date:

10/06/2025

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the codform parameter in /modules/forms/collectform.asp.

Severity CVSS v4.0: CRITICAL

Last modification:

22/10/2025

CVE-2025-40658

Publication date:

10/06/2025

An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/framesSelection.asp.

Severity CVSS v4.0: MEDIUM

Last modification:

22/10/2025

CVE-2025-40659

Publication date:

10/06/2025

Severity CVSS v4.0: MEDIUM

Last modification:

22/10/2025

CVE-2025-40660

Publication date:

10/06/2025

Severity CVSS v4.0: MEDIUM

Last modification:

22/10/2025

CVE-2025-40661

Publication date:

10/06/2025

Severity CVSS v4.0: MEDIUM

Last modification:

22/10/2025

CVE-2025-40655

Publication date:

10/06/2025

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name parameter in /antcatalogue.asp.

Severity CVSS v4.0: CRITICAL

Last modification:

23/10/2025

Subscribe to Vulnerabilities