Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2025-24307
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Improper privilege management for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable data manipulation. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Gravedad CVSS v4.0: BAJA
Última modificación:
12/11/2025

CVE-2025-24314
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Improper access control for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Gravedad CVSS v4.0: BAJA
Última modificación:
12/11/2025

CVE-2025-20050
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Uncontrolled search path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Gravedad CVSS v4.0: MEDIA
Última modificación:
12/11/2025

CVE-2025-20056
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Gravedad CVSS v4.0: MEDIA
Última modificación:
12/11/2025

CVE-2025-20065
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Uncontrolled search path for some Display Virtualization for Windows OS software before version 1797 within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Gravedad CVSS v4.0: MEDIA
Última modificación:
12/11/2025

CVE-2025-20614
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** External control of file name or path for some Intel(R) CIP software before version WIN_DCA_2.4.0.11001 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Gravedad CVSS v4.0: MEDIA
Última modificación:
12/11/2025

CVE-2025-20622
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Sensitive information uncleared in resource before release for reuse for some Intel(R) NPU Drivers for Windows before version 32.0.100.4023 within Ring 3: User Applications may allow an information disclosure. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Gravedad CVSS v4.0: BAJA
Última modificación:
12/11/2025

CVE-2025-22391
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Improper access control for some SigTest before version 6.1.10 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Gravedad CVSS v4.0: MEDIA
Última modificación:
12/11/2025

CVE-2025-12940
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610<br /> and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Managed WiFi 6<br /> Access Points). An user having access to the syslog server can read the logs containing these credentials. <br /> <br /> This issue affects WAX610: before 10.8.11.4; WAX610Y: before 10.8.11.4.<br /> <br /> <br /> Devices<br /> managed with Insight get automatic updates. If not, please check the firmware version<br /> and update to the latest. <br /> <br /> <br /> <br /> <br /> <br /> Fixed in:<br /> <br /> <br /> <br /> WAX610 firmware<br /> 11.8.0.10 or later.<br /> <br /> <br /> <br /> WAX610Y firmware<br /> 11.8.0.10 or later.
Gravedad CVSS v4.0: BAJA
Última modificación:
12/11/2025

CVE-2025-12942
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attacks and control over DNS Server to perform command execution.This issue affects R6260: through 1.1.0.86; R6850: through 1.1.0.86.
Gravedad CVSS v4.0: MEDIA
Última modificación:
12/11/2025

CVE-2025-12943
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Improper certificate<br /> validation in firmware update logic in NETGEAR RAX30 (Nighthawk AX5 5-Stream<br /> AX2400 WiFi 6 Router) and RAXE300 (Nighthawk AXE7800 Tri-Band<br /> WiFi 6E Router) allows attackers with the ability to intercept and<br /> tamper traffic destined to the device to execute arbitrary commands on the<br /> device.<br /> <br /> Devices<br /> with automatic updates enabled may already have this patch applied. If not,<br /> please check the firmware version and update to the<br /> latest.<br /> <br /> <br /> <br /> Fixed in:<br /> <br /> <br /> <br /> RAX30 firmware<br /> 1.0.14.108 or later.<br /> <br /> <br /> <br /> RAXE300 firmware<br /> 1.0.9.82 or later
Gravedad CVSS v4.0: MEDIA
Última modificación:
12/11/2025

CVE-2025-12944
Fecha de publicación:
11/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Improper input validation<br /> in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with<br /> direct network access to the device to potentially execute code on the device.<br /> <br /> Please check the firmware version and update to the latest.<br /> <br /> <br /> <br /> Fixed<br /> in:<br /> <br /> <br /> <br />  DGN2200v4<br /> firmware 1.0.0.132 or later
Gravedad CVSS v4.0: MEDIA
Última modificación:
12/11/2025
Suscribirse a Vulnerabilidades