Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-36890

Publication date:

18/12/2025

An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests. Attackers could potentially compromise global administrator accounts and invalidate security-sensitive macros by manipulating user privilege levels.

Severity CVSS v4.0: HIGH

Last modification:

24/12/2025

CVE-2019-25230

Publication date:

18/12/2025

An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live site widget properties dialog. Attackers can exploit this vulnerability to access unauthorized system information without proper access controls.

Severity CVSS v4.0: MEDIUM

Last modification:

24/12/2025

CVE-2020-36889

Publication date:

18/12/2025

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via error messages containing specially crafted object names. This allows malicious scripts to execute in users&#39; browsers when administrators view error messages in the administration interface.

Severity CVSS v4.0: MEDIUM

Last modification:

27/12/2025

CVE-2020-36891

Publication date:

18/12/2025

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users&#39; browsers.

Severity CVSS v4.0: MEDIUM

Last modification:

27/12/2025

CVE-2022-50680

Publication date:

18/12/2025

A stored cross-site scripting vulnerability in Kentico Xperience allows administration users to inject malicious scripts via email marketing templates. Attackers can exploit this vulnerability to execute malicious scripts that could compromise user browsers and steal sensitive information.

Severity CVSS v4.0: MEDIUM

Last modification:

27/12/2025

CVE-2019-25229

Publication date:

18/12/2025

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with &#39;Read data&#39; permissions to upload arbitrary file types via MVC form file uploader components. Attackers can manipulate file names and upload potentially malicious files to the system, enabling unauthorized file uploads.

Severity CVSS v4.0: HIGH

Last modification:

24/12/2025

CVE-2019-25228

Publication date:

18/12/2025

An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to external domains through page builder interactions and link/image loading.

Severity CVSS v4.0: MEDIUM

Last modification:

24/12/2025

CVE-2025-67745

Publication date:

18/12/2025

MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the whole backup info, including the encryption key. Version 1.3.0 fixes the issue. As a workaround, direct logs into /dev/null.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2025

CVE-2025-65565

Publication date:

18/12/2025

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association is established, a PFCP Session Establishment Request that is missing the mandatory F-SEID (CPF-SEID) Information Element is not properly validated. The session establishment handler calls IE.FSEID() on a nil pointer, which triggers a panic and terminates the UPF process. An attacker who can send PFCP Session Establishment Request messages to the UPF&#39;s N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2026

CVE-2025-65567

Publication date:

18/12/2025

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a specially crafted PFCP Session Establishment Request with a CreatePDR that contains a malformed Flow-Description is not robustly validated. The Flow-Description parser (parseFlowDesc) can read beyond the bounds of the provided buffer, causing a panic and terminating the UPF process. An attacker who can send PFCP Session Establishment Request messages to the UPF&#39;s N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2026

CVE-2025-65568

Publication date:

18/12/2025

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP Session Establishment Request that includes a CreateFAR with an empty or truncated IPv4 address field is not properly validated. During parsing, parseFAR() calls ip2int(), which performs an out-of-bounds read on the IPv4 address buffer and triggers an index-out-of-range panic. An attacker who can send PFCP Session Establishment Request messages to the UPF&#39;s N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.

Severity CVSS v4.0: Pending analysis

Last modification:

07/01/2026

CVE-2025-65559

Publication date:

18/12/2025

An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertion in `lib/pfcp/context.c` (`ogs_pfcp_object_teid_hash_set`) if the CreatePDR?PDI?F-TEID has CH=1 and the F-TEID address-family flag(s) (IPv4/IPv6) do not match the GTP-U resource family configured for the selected DNN (Network Instance), resulting in a denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

06/01/2026

Subscribe to Vulnerabilities