Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-52459
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that allows for argument <br /> injection in NetworkServlet.backupDatabase(). This issue requires an <br /> authenticated attacker with at least user-level privileges. Certain <br /> parameters can be used directly in a command without proper <br /> sanitization, allowing arbitrary arguments to be injected. This can <br /> result in information disclosure, including sensitive database <br /> credentials.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-52579
Publication date:
11/07/2025
Emerson ValveLink Products store sensitive information in cleartext in memory. The <br /> sensitive memory might be saved to disk, stored in a core dump, or <br /> remain uncleared if the product crashes, or if the programmer does not <br /> properly clear the memory before freeing it.
Severity CVSS v4.0: CRITICAL
Last modification:
11/07/2025

CVE-2025-53397
Publication date:
11/07/2025
A vulnerability exists in Advantech iView versions prior to 5.7.05 build<br /> 7057, which could allow a reflected cross-site scripting (XSS) attack. <br /> By exploiting this flaw, an attacker could execute unauthorized scripts <br /> in the user&amp;#39;s browser, potentially leading to information disclosure or <br /> other malicious activities.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-53471
Publication date:
11/07/2025
Emerson ValveLink products <br /> receive input or data, but it do not validate or incorrectly <br /> validates that the input has the properties that are required to process<br /> the data safely and correctly.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-46704
Publication date:
11/07/2025
A vulnerability exists in Advantech iView in <br /> NetworkServlet.processImportRequest() that could allow for a directory <br /> traversal attack. This issue requires an authenticated attacker with at <br /> least user-level privileges. A specific parameter is not properly <br /> sanitized or normalized, potentially allowing an attacker to determine <br /> the existence of arbitrary files on the server.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-48891
Publication date:
11/07/2025
A vulnerability exists in Advantech iView that could allow for SQL <br /> injection through the CUtils.checkSQLInjection() function. This <br /> vulnerability can be exploited by an authenticated attacker with at <br /> least user-level privileges, potentially leading to information <br /> disclosure or a denial-of-service condition.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-46358
Publication date:
11/07/2025
Emerson ValveLink products <br /> do not use or incorrectly uses a protection mechanism that provides <br /> sufficient defense against directed attacks against the product.
Severity CVSS v4.0: HIGH
Last modification:
11/07/2025

CVE-2025-48496
Publication date:
11/07/2025
Emerson ValveLink products <br /> use a fixed or controlled search path to find resources, but one or <br /> more locations in that path can be under the control of unintended <br /> actors.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-41442
Publication date:
11/07/2025
A vulnerability exists in Advantech iView versions prior to 5.7.05 build<br /> 7057, which could allow a reflected cross-site scripting (XSS) attack. <br /> By manipulating certain input parameters, an attacker could execute <br /> unauthorized scripts in the user&amp;#39;s browser, potentially leading to <br /> information disclosure or other malicious activities.
Severity CVSS v4.0: MEDIUM
Last modification:
11/07/2025

CVE-2025-7419
Publication date:
10/07/2025
A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been classified as critical. This affects the function fromSpeedTestSet of the file /goform/setRateTest of the component httpd. The manipulation of the argument destIP leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: HIGH
Last modification:
10/07/2025

CVE-2025-7418
Publication date:
10/07/2025
A vulnerability was found in Tenda O3V2 1.0.0.12(3880) and classified as critical. Affected by this issue is the function fromPingResultGet of the file /goform/setPing of the component httpd. The manipulation of the argument destIP leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: HIGH
Last modification:
10/07/2025

CVE-2025-1727
Publication date:
10/07/2025
The protocol used for remote linking over RF for End-of-Train and <br /> Head-of-Train (also known as a FRED) relies on a BCH checksum for packet<br /> creation. It is possible to create these EoT and HoT packets with a <br /> software defined radio and issue brake control commands to the EoT <br /> device, disrupting operations or potentially overwhelming the brake <br /> systems.
Severity CVSS v4.0: HIGH
Last modification:
10/07/2025
Subscribe to Vulnerabilities