Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-41797

Publication date:

10/06/2025

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions

Severity CVSS v4.0: MEDIUM

Last modification:

12/06/2025

CVE-2025-46612

Publication date:

10/06/2025

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console (default credentials are weak and easily guessable) and upload a JSP file via the Panel Designer dashboard.

Severity CVSS v4.0: Pending analysis

Last modification:

16/10/2025

CVE-2025-5353

Publication date:

10/06/2025

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2025

CVE-2025-5335

Publication date:

10/06/2025

A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the Autodesk Installer application. Exploitation of this vulnerability may lead to code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

13/11/2025

CVE-2025-30145

Publication date:

10/06/2025

GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This vulnerability is fixed in 2.27.0, 2.26.3, and 2.25.7. This vulnerability can be mitigated by disabling WMS dynamic styling and the Jiffle process.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2025

CVE-2025-37100

Publication date:

10/06/2025

A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploitation could allow an attacker to iteratively navigate through the filesystem and ultimately download protected system files containing sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

12/06/2025

CVE-2024-40625

Publication date:

10/06/2025

GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals &#39;url&#39;) with no restrict. This vulnerability is fixed in 2.26.0.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2025

CVE-2025-22455

Publication date:

10/06/2025

A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2025

CVE-2025-22463

Publication date:

10/06/2025

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2025

CVE-2025-27505

Publication date:

10/06/2025

GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST API index can disclose whether certain extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2025

CVE-2025-26395

Publication date:

10/06/2025

SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL. The attack requires authentication using an administrator-level account and user interaction is required.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

CVE-2025-26394

Publication date:

10/06/2025

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.

Severity CVSS v4.0: Pending analysis

Last modification:

12/11/2025

Subscribe to Vulnerabilities