Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-1870

Publication date:

16/03/2026

The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the &#39;thim-ekit/archive-course/get-courses&#39; REST endpoint callback function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to disclose private or draft LearnPress course content by supplying post_status in the params_url payload.

Severity CVSS v4.0: Pending analysis

Last modification:

22/04/2026

CVE-2026-0385

Publication date:

16/03/2026

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

07/04/2026

CVE-2025-71264

Publication date:

16/03/2026

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash).

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2026

CVE-2025-69246

Publication date:

16/03/2026

Raytha CMS does not have any brute force protection mechanism implemented. It allows an attacker to send multiple automated logon requests without triggering lockout, throttling, or step-up challenges. This issue was fixed in version 1.4.6.

Severity CVSS v4.0: MEDIUM

Last modification:

16/03/2026

CVE-2025-6969

Publication date:

16/03/2026

in OpenHarmony v5.1.0 and prior versions allow a local attacker cause DOS through improper input.

Severity CVSS v4.0: Pending analysis

Last modification:

17/03/2026

CVE-2025-69239

Publication date:

16/03/2026

Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the URL for redirecting server-side HTTP request. This issue was fixed in version 1.4.6.

Severity CVSS v4.0: MEDIUM

Last modification:

16/03/2026

CVE-2025-69240

Publication date:

16/03/2026

Raytha CMS allows an attacker to spoof `X-Forwarded-Host` or `Host` headers to attacker controlled domain. The attacker (who knows the victim&#39;s email address) can force the server to send an email with password reset link pointing to the domain from spoofed header. When victim clicks the link, browser sends request to the attacker’s domain with the token in the path allowing the attacker to capture the token. This allows the attacker to reset victim&#39;s password and take over the victim&#39;s account. This issue was fixed in version 1.4.6.

Severity CVSS v4.0: HIGH

Last modification:

16/03/2026

CVE-2025-69241

Publication date:

16/03/2026

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6.

Severity CVSS v4.0: MEDIUM

Last modification:

16/03/2026

CVE-2025-69242

Publication date:

16/03/2026

Raytha CMS is vulnerable to reflected XSS via the backToListUrl parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue was fixed in version 1.4.6.

Severity CVSS v4.0: MEDIUM

Last modification:

16/03/2026

CVE-2025-69243

Publication date:

16/03/2026

Raytha CMS is vulnerable to User Enumeration in password reset functionality. Difference in messages could allow an attacker to determine if the login is valid or not, enabling a brute force attack with valid logins. This issue was fixed in version 1.5.0.

Severity CVSS v4.0: MEDIUM

Last modification:

16/03/2026

CVE-2025-69245

Publication date:

16/03/2026

Raytha CMS is vulnerable to Reflected XSS via returnUrl parameter in logon functionality. An attacker can craft a malicious URL which, when opened by the authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue was fixed in 1.4.6.

Severity CVSS v4.0: MEDIUM

Last modification:

16/03/2026

CVE-2025-69236

Publication date:

16/03/2026

Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Value parameter in post editing functionality. Authenticated attacker with permissions to edit posts can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6.

Severity CVSS v4.0: MEDIUM

Last modification:

16/03/2026

Subscribe to Vulnerabilities