Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-14850
Publication date:
18/12/2025
Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.
Severity CVSS v4.0: HIGH
Last modification:
31/12/2025

CVE-2025-14849
Publication date:
18/12/2025
Advantech WebAccess/SCADA <br /> is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.
Severity CVSS v4.0: HIGH
Last modification:
31/12/2025

CVE-2025-14848
Publication date:
18/12/2025
Advantech WebAccess/SCADA<br /> is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.
Severity CVSS v4.0: MEDIUM
Last modification:
31/12/2025

CVE-2025-67163
Publication date:
18/12/2025
A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
31/12/2025

CVE-2025-64400
Publication date:
18/12/2025
Control Panel provides an API for pre-registering into an enrollment and organization prior to a user&amp;#39;s first login. The API for creating users checks that the account requesting a user creation has `edit` on the enrollment-level user directory, but is missing a separate check that the enrollment editor has access (or belongs to) the organization that they are adding a user to.
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2025

CVE-2025-65566
Publication date:
18/12/2025
A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Session Report Response that is missing the mandatory Cause Information Element, the session report handler dereferences a nil pointer instead of rejecting the malformed message. This triggers a panic and terminates the UPF process. An attacker who can send PFCP Session Report Response messages to the UPF&amp;#39;s N4/PFCP endpoint can exploit this flaw to repeatedly crash the UPF and disrupt user-plane services.
Severity CVSS v4.0: Pending analysis
Last modification:
06/01/2026

CVE-2025-14889
Publication date:
18/12/2025
A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unknown function of the file /admin/voters_edit.php of the component Password Handler. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Severity CVSS v4.0: MEDIUM
Last modification:
24/02/2026

CVE-2024-58321
Publication date:
18/12/2025
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers can exploit this vulnerability to execute malicious scripts that will run in users&amp;#39; browsers.
Severity CVSS v4.0: MEDIUM
Last modification:
27/12/2025

CVE-2024-58322
Publication date:
18/12/2025
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This could lead to potential theft of sensitive data by executing malicious scripts in users&amp;#39; browsers.
Severity CVSS v4.0: MEDIUM
Last modification:
27/12/2025

CVE-2024-58323
Publication date:
18/12/2025
A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows malicious scripts to execute in users&amp;#39; browsers by exploiting HTML support in the form builder.
Severity CVSS v4.0: MEDIUM
Last modification:
27/12/2025

CVE-2024-58317
Publication date:
18/12/2025
A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the &amp;#39;requireSSL&amp;#39; attribute, potentially compromising session security and authentication state.
Severity CVSS v4.0: MEDIUM
Last modification:
24/12/2025

CVE-2024-58320
Publication date:
18/12/2025
An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication. Attackers can retrieve confidential hostname configuration information through a public endpoint, potentially exposing internal network details.
Severity CVSS v4.0: MEDIUM
Last modification:
24/12/2025
Subscribe to Vulnerabilities