CVE Program · INCIBE
CVE Numbering Authority (CNA)
Since February 2025 ATISoluciones has been a CVE Numbering Authority (CNA). The designation, granted by the CVE Program and supervised by the Spanish National Cybersecurity Institute (INCIBE), recognises our ability to identify, designate and assign unique identifiers (CVE IDs) to vulnerabilities discovered in our products and services.
The CVE Program
What a CVE is and why it matters
The mission of the CVE Program is to identify, define and catalogue publicly disclosed cybersecurity vulnerabilities. Each one receives a unique identifier, in the format CVE-year-number, which allows security professionals to share information about it consistently and accurately.
As a CNA we are part of a global network of organisations working together to improve cybersecurity, and we can manage and disclose vulnerabilities in our products more quickly and accurately.
For your organisation
What it means for users of our products
Advance notice
Affected clients receive notice and remediation guidance 15 days before public disclosure.
Recognisable identifier
Each vulnerability has a CVE that your tools and your team can track in their vulnerability management.
Fixed version
Each publication states the version that fixes the issue, useful as evidence in an ENS audit.
Coordinated disclosure
How to report a vulnerability
-
Report
By email, with a description, impact and steps to reproduce it.
-
Assessment
We validate the vulnerability and prioritise it according to its impact.
-
Fix and notice
We develop the fix and notify affected clients.
-
Publication
Coordinated public disclosure with its CVE identifier.
Reporting channel
Send your report to the information security team:
cve@atisoluciones.comThe identity of whoever discovers the vulnerability is protected on request. Before carrying out any testing, please read the conditions in the disclosure policy.
Transparency
Published vulnerabilities and documents
| CVE | Vulnerability details | Publication | Fixed in |
|---|---|---|---|
CVE-2025-13596 |
Improper Error Handling Leading to Sensitive Information Disclosure in CIGES ≤ 2.15.6 | 24/11/2025 | 2.15.7 |
CVE-2025-1751 |
A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones. | 27/02/2025 | 2.15.6 |
Frequently asked questions
Questions about the CNA role
What is a CVE Numbering Authority (CNA)?
It is an organisation authorised by the CVE Program to assign CVE identifiers to vulnerabilities within a specific scope and publish their records. In our case, the scope is vulnerabilities discovered in our products and services.
How do I report a vulnerability in an ATISoluciones product?
Email cve@atisoluciones.com with a description, the potential impact and the steps to reproduce it. The conditions for security testing are set out in our vulnerability disclosure policy.
When is a vulnerability published?
Once the fix has been developed and applied, provided this does not compromise the security of systems. Beforehand, affected clients receive notice and guidance on how to fix it 15 days before public disclosure.
Have you found a vulnerability in one of our products?
Report it to the information security team and we will coordinate its fix and disclosure with you.
