Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-2179

Publication date:

29/07/2025

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on Linux devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so.<br /> <br /> The GlobalProtect app on Windows, macOS, iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2025-2928

Publication date:

29/07/2025

SQL Injection affecting the Archiver role.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-27514

Publication date:

29/07/2025

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0 through 10.0.18, a technician can use a malicious payload to trigger a stored XSS on the project&#39;s kanban. This is fixed in version 10.0.19.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2025

CVE-2025-54420

Publication date:

29/07/2025

Rejected reason: This CVE is a duplicate of CVE-2025-8129.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2025

CVE-2025-54432

Publication date:

29/07/2025

Rejected reason: This CVE is a duplicate of another CVE. See CVE-2018-25031 and CVE-2021-46708.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2025

CVE-2025-44136

Publication date:

29/07/2025

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim&#39;s browser.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2025

CVE-2025-44137

Publication date:

29/07/2025

MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format"

Severity CVSS v4.0: Pending analysis

Last modification:

20/01/2026

CVE-2025-31965

Publication date:

29/07/2025

Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2025-5922

Publication date:

29/07/2025

Access to TSplus Remote Access Admin Tool is restricted to administrators (unless "Disable UAC" option is enabled) and requires a PIN code. In versions below v18.40.6.17 the PIN&#39;s hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack using rainbow tables, since the hash is not salted.<br /> LTS (Long-Term Support) versions also received patches in v17.2025.6.27 and v16.2025.6.27 releases.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2025-28170

Publication date:

29/07/2025

Grandstream Networks GXP1628

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2025

CVE-2025-28171

Publication date:

29/07/2025

An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2025

CVE-2025-50738

Publication date:

29/07/2025

The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be exploited by an attacker to disclose the viewing user&#39;s IP address, browser User-Agent string, and potentially other request-specific information to the attacker-controlled server, leading to information disclosure and user tracking.

Severity CVSS v4.0: Pending analysis

Last modification:

22/08/2025

Subscribe to Vulnerabilities