Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-10483

Publication date:

26/02/2025

The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2025

CVE-2024-10152

Publication date:

26/02/2025

The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2025

CVE-2022-25773

Publication date:

26/02/2025

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of the intended temporary directory.

Severity CVSS v4.0: Pending analysis

Last modification:

16/10/2025

CVE-2025-22881

Publication date:

26/02/2025

Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target visits a malicious page or opens a malicious file an attacker can leverage this vulnerability to execute code in the context of the current process.

Severity CVSS v4.0: HIGH

Last modification:

11/07/2025

CVE-2025-22868

Publication date:

26/02/2025

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2025-22869

Publication date:

26/02/2025

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

Severity CVSS v4.0: Pending analysis

Last modification:

01/05/2025

CVE-2025-0889

Publication date:

26/02/2025

Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process.

Severity CVSS v4.0: HIGH

Last modification:

31/07/2025

CVE-2025-0234

Publication date:

26/02/2025

Out-of-bounds vulnerability in curve segmentation processing of Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2025

CVE-2025-0235

Publication date:

26/02/2025

Out-of-bounds vulnerability due to improper memory release during image rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2025

CVE-2025-0236

Publication date:

26/02/2025

Out-of-bounds vulnerability in slope processing during curve rendering in Generic PCL6 V4 Printer Driver / Generic UFR II V4 Printer Driver / Generic LIPSLX V4 Printer Driver.

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2025

CVE-2022-49729

Publication date:

26/02/2025

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred Similar to the handling of play_deferred in commit 19cfe912c37b ("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought a patch might be needed here as well. Currently usb_submit_urb is called directly to submit deferred tx urbs after unanchor them. So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb and cause memory leak. Put those urbs in tx_anchor to avoid the leak, and also fix the error handling.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2025

CVE-2022-49731

Publication date:

26/02/2025

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() In an unlikely (and probably wrong?) case that the &#39;ppi&#39; parameter of ata_host_alloc_pinfo() points to an array starting with a NULL pointer, there&#39;s going to be a kernel oops as the &#39;pi&#39; local variable won&#39;t get reassigned from the initial value of NULL. Initialize &#39;pi&#39; instead to &#39;&ata_dummy_port_info&#39; to fix the possible kernel oops for good... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2025

Subscribe to Vulnerabilities