Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-53544

Publication date:

24/02/2025

NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the smarttimeplus/MySQLConnection endpoint.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-56525

Publication date:

24/02/2025

In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-53542

Publication date:

24/02/2025

Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 allows attackers to arbitrarily restart the NCServiceManger via a crafted GET request.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-27141

Publication date:

24/02/2025

Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.47.0 and prior to versions 1.50.36, 1.51.14, 1.52.11, and 1.53.2 of Metabase Enterprise Edition, users with impersonation permissions may be able to see results of cached questions, even if their permissions don’t allow them to see the data. If some user runs a question which gets cached, and then an impersonated user runs that question, then the impersonated user sees the same results as the previous user. These cached results may include data the impersonated user should not have access to. This vulnerability only impacts the Enterprise Edition of Metabase and not the Open Source Edition. Versions 1.53.2, 1.52.11, 1.51.14, and 1.50.36 contains a patch. Versions on the 1.49.X, 1.48.X, and 1.47.X branches are vulnerable but do not have a patch available, so users should upgrade to a major version with an available fix. Disabling question caching is a workaround for this issue.

Severity CVSS v4.0: MEDIUM

Last modification:

28/02/2025

CVE-2025-25513

Publication date:

24/02/2025

Seacms

Severity CVSS v4.0: Pending analysis

Last modification:

14/03/2025

CVE-2025-27140

Publication date:

24/02/2025

WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application, `importar_dump.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. The command is basically a command to move a temporary file, so a webshell upload is also possible. Version 3.2.15 contains a patch for the issue.

Severity CVSS v4.0: CRITICAL

Last modification:

28/02/2025

CVE-2024-57608

Publication date:

24/02/2025

An issue in Via Browser 6.1.0 allows a a remote attacker to execute arbitrary code via the mark.via.Shell component.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-26533

Publication date:

24/02/2025

An SQL injection risk was identified in the module list filter within course search.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2025

CVE-2025-27137

Publication date:

24/02/2025

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` permission to customize notification templates. Templates are evaluated using the Pebble template engine. Pebble supports an `include` tag, which allows template authors to include the content of arbitrary files upon evaluation. Prior to version 4.12.6, users of Dependency-Track with the `SYSTEM_CONFIGURATION` permission can abuse the `include` tag by crafting notification templates that `include` sensitive local files, such as `/etc/passwd` or `/proc/1/environ`. By configuring such a template for a notification rule (aka "Alert"), and having it send notifications to a destination controlled by the actor, sensitive information may be leaked. The issue has been fixed in Dependency-Track 4.12.6. In fixed versions, the `include` tag can no longer be used. Usage of the tag will cause template evaluation to fail. As a workaround, avoid assigning the `SYSTEM_CONFIGURATION` permission to untrusted users. The `SYSTEM_CONFIGURATION` permission per default is only granted to members of the `Administrators` team. Assigning this permission to non-administrative users or teams is a security risk in itself, and highly discouraged.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-26532

Publication date:

24/02/2025

Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2025

CVE-2025-26525

Publication date:

24/02/2025

Insufficient sanitizing in the TeX notation filter resulted in an <br /> arbitrary file read risk on sites where pdfTeX is available (such as <br /> those with TeX Live installed).

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2025

CVE-2025-26526

Publication date:

24/02/2025

Separate Groups mode restrictions were not factored into permission <br /> checks before allowing viewing or deletion of responses in Feedback <br /> activities.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2025

Subscribe to Vulnerabilities