Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-32784
Publication date:
15/04/2025
conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized as a Time-of-Check to Time-of-Use (TOCTOU) issue, can be exploited to introduce unauthorized modifications to build artifacts stored in the cf-staging Anaconda channel. Exploitation may result in the unauthorized publication of malicious artifacts to the production conda-forge channel. The core vulnerability results from the absence of atomicity between the hash validation and the artifact copy operation. This gap allows an attacker, with access to the cf-staging token, to overwrite the validated artifact with a malicious version immediately after hash verification, but before the copy action is executed. As the cf-staging channel permits artifact overwrites, such an operation can be carried out using the anaconda upload --force command. This vulnerability is fixed in 2025.4.10.
Severity CVSS v4.0: HIGH
Last modification:
16/04/2025

CVE-2025-32923
Publication date:
15/04/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Tourmaster allows Reflected XSS. This issue affects Tourmaster: from n/a through n/a.
Severity CVSS v4.0: Pending analysis
Last modification:
16/04/2025

CVE-2025-30984
Publication date:
15/04/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound SEO Tools allows Reflected XSS. This issue affects SEO Tools: from n/a through 4.0.7.
Severity CVSS v4.0: Pending analysis
Last modification:
16/04/2025

CVE-2025-31147
Publication date:
15/04/2025
Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
Severity CVSS v4.0: MEDIUM
Last modification:
16/04/2025

CVE-2025-31360
Publication date:
15/04/2025
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.
Severity CVSS v4.0: MEDIUM
Last modification:
16/04/2025

CVE-2025-31654
Publication date:
15/04/2025
An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
Severity CVSS v4.0: MEDIUM
Last modification:
16/04/2025

CVE-2025-31945
Publication date:
15/04/2025
An unauthenticated attacker can obtain other users' charger information.
Severity CVSS v4.0: MEDIUM
Last modification:
16/04/2025

CVE-2025-31950
Publication date:
15/04/2025
An unauthenticated attacker can obtain EV charger energy consumption information of other users.
Severity CVSS v4.0: MEDIUM
Last modification:
16/04/2025

CVE-2025-30966
Publication date:
15/04/2025
Path Traversal vulnerability in NotFound WPJobBoard allows Path Traversal. This issue affects WPJobBoard: from n/a through n/a.
Severity CVSS v4.0: Pending analysis
Last modification:
16/04/2025

CVE-2025-30967
Publication date:
15/04/2025
Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Upload a Web Shell to a Web Server. This issue affects WPJobBoard: from n/a through n/a.
Severity CVSS v4.0: Pending analysis
Last modification:
16/04/2025

CVE-2025-30970
Publication date:
15/04/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Easy Contact allows Reflected XSS. This issue affects Easy Contact: from n/a through 0.1.2.
Severity CVSS v4.0: Pending analysis
Last modification:
16/04/2025

CVE-2025-30982
Publication date:
15/04/2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookProgress by Stormhill Media allows Stored XSS. This issue affects MyBookProgress by Stormhill Media: from n/a through 1.0.8.
Severity CVSS v4.0: Pending analysis
Last modification:
16/04/2025
Subscribe to Vulnerabilities