Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-27936
Publication date:
16/04/2025
Mattermost Plugin MSTeams versions
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2026

CVE-2025-3678
Publication date:
16/04/2025
A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component HELP Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
12/05/2025

CVE-2025-3104
Publication date:
16/04/2025
The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plugins.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2025-3677
Publication date:
16/04/2025
A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem of the file fastchat/model/apply_delta.py. The manipulation leads to deserialization. An attack has to be approached locally.
Severity CVSS v4.0: MEDIUM
Last modification:
15/04/2026

CVE-2024-22036
Publication date:
16/04/2025
A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot<br /> jail and gain root access to the Rancher container itself. In <br /> production environments, further privilege escalation is possible based <br /> on living off the land within the Rancher container itself. For the test<br /> and development environments, based on a –privileged Docker container, <br /> it is possible to escape the Docker container and gain execution access <br /> on the host system.<br /> <br /> <br /> This issue affects rancher: from 2.7.0 before 2.7.16, from 2.8.0 before 2.8.9, from 2.9.0 before 2.9.3.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2024-52281
Publication date:
16/04/2025
A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.<br /> This issue affects rancher: from 2.9.0 before 2.9.4.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2023-32197
Publication date:
16/04/2025
A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5.
Severity CVSS v4.0: HIGH
Last modification:
15/04/2026

CVE-2025-27538
Publication date:
16/04/2025
Mattermost versions 10.5.x
Severity CVSS v4.0: Pending analysis
Last modification:
01/10/2025

CVE-2025-27571
Publication date:
16/04/2025
Mattermost versions 10.5.x
Severity CVSS v4.0: Pending analysis
Last modification:
01/10/2025

CVE-2025-3077
Publication date:
16/04/2025
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&amp;#39;s Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity CVSS v4.0: Pending analysis
Last modification:
04/06/2025

CVE-2025-3676
Publication date:
16/04/2025
A vulnerability classified as critical has been found in xxyopen Novel-Plus 3.5.0. This affects an unknown part of the file /api/front/search/books. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity CVSS v4.0: MEDIUM
Last modification:
23/04/2025

CVE-2025-24839
Publication date:
16/04/2025
Mattermost versions 10.5.x
Severity CVSS v4.0: Pending analysis
Last modification:
02/10/2025
Subscribe to Vulnerabilities