Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-37049

Publication date:

30/01/2026

Frigate 3.36.0.9 contains a local buffer overflow vulnerability in the Command Line input field that allows attackers to execute arbitrary code. Attackers can craft a malicious payload to overflow the buffer, bypass DEP, and execute commands like launching calc.exe through a specially crafted input sequence.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37050

Publication date:

30/01/2026

Quick Player 1.3 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious .m3l file with carefully constructed payload. Attackers can trigger the vulnerability by loading a specially crafted file through the application&#39;s file loading mechanism, potentially enabling remote code execution.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37051

Publication date:

30/01/2026

Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes. Attackers can exploit the &#39;feed.php&#39; endpoint by crafting malicious payload requests that use time delays to systematically enumerate user password characters.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37036

Publication date:

30/01/2026

RM Downloader 2.50.60 contains a local buffer overflow vulnerability in the &#39;Load&#39; parameter that allows attackers to execute arbitrary code by overwriting memory. Attackers can craft a malicious payload with an egg hunter technique to bypass memory protections and execute commands like launching calc.exe.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37038

Publication date:

30/01/2026

Code Blocks 20.03 contains a denial of service vulnerability that allows attackers to crash the application by manipulating input in the FSymbols search field. Attackers can paste a large payload of 5000 repeated characters into the search field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

30/01/2026

CVE-2020-37039

Publication date:

30/01/2026

Frigate 2.02 contains a denial of service vulnerability that allows attackers to crash the application by sending oversized input to the command line interface. Attackers can generate a payload of 8000 repeated characters and paste it into the application&#39;s command line field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

30/01/2026

CVE-2020-37040

Publication date:

30/01/2026

Code Blocks 17.12 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by crafting a malicious file name with Unicode characters. Attackers can trigger the vulnerability by pasting a specially crafted payload into the file name field during project creation, potentially executing system commands like calc.exe.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37041

Publication date:

30/01/2026

OpenCTI 3.3.1 is vulnerable to a directory traversal attack via the static/css endpoint. An unauthenticated attacker can read arbitrary files from the filesystem by sending crafted GET requests with path traversal sequences (e.g., &#39;../&#39;) in the URL. For example, requesting /static/css//../../../../../../../../etc/passwd returns the contents of /etc/passwd. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37042

Publication date:

30/01/2026

Frigate Professional 3.36.0.9 contains a local buffer overflow vulnerability in the &#39;Find Computer&#39; feature that allows attackers to execute arbitrary code by overflowing the computer name input field. Attackers can craft a malicious payload that triggers a buffer overflow, enabling code execution and launching calculator as a proof of concept.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37029

Publication date:

30/01/2026

FTPDummy 4.80 contains a local buffer overflow vulnerability in its preference file handling that allows attackers to execute arbitrary code. Attackers can craft a malicious preference file with carefully constructed shellcode to trigger a structured exception handler overwrite and execute system commands.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37031

Publication date:

30/01/2026

Simple Startup Manager 1.17 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory through the &#39;File&#39; input parameter. Attackers can craft a malicious payload with 268 bytes to trigger code execution, bypassing DEP and overwriting memory addresses to launch calc.exe.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

CVE-2020-37032

Publication date:

30/01/2026

Wing FTP Server 6.3.8 contains a remote code execution vulnerability in its Lua-based web console that allows authenticated users to execute system commands. Attackers can leverage the console to send POST requests with malicious commands that trigger operating system execution through the os.execute() function.

Severity CVSS v4.0: HIGH

Last modification:

30/01/2026

Subscribe to Vulnerabilities