Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-49199

Publication date:

12/06/2025

The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to run, making the application unusable. They can redirect traffic that is meant to be internal to their own hosted services and gathering information.

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2025-49198

Publication date:

12/06/2025

The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2025-49197

Publication date:

12/06/2025

The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2025-49196

Publication date:

12/06/2025

A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users or devices, affecting the confidentiality and integrity of the device.

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2025-49195

Publication date:

12/06/2025

The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potentially compromising the FTP server.

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2025-49194

Publication date:

12/06/2025

The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to intercept traffic between a client and this server, the credentials would be exposed.

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2025-49193

Publication date:

12/06/2025

The application fails to implement several security headers. These headers help increase the overall security level of the web application by e.g., preventing the application to be displayed in an iFrame (Clickjacking attacks) or not executing injected malicious JavaScript code (XSS attacks).

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2025-49192

Publication date:

12/06/2025

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of their computer while clicking on seemingly innocuous objects.

Severity CVSS v4.0: Pending analysis

Last modification:

06/02/2026

CVE-2024-56158

Publication date:

12/06/2025

XWiki is a generic wiki platform. It&#39;s possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.

Severity CVSS v4.0: CRITICAL

Last modification:

12/01/2026

CVE-2025-49191

Publication date:

12/06/2025

Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, making it possible to attack other users that access the dashboard by including malicious code. The attack is only possible if the attacker is authorized to create new dashboards or iFrame widgets.

Severity CVSS v4.0: Pending analysis

Last modification:

29/01/2026