Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-14389

Publication date:
18/07/2018
joyplus-cms 1.6.0 has SQL Injection via the manager/admin_ajax.php val parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-12429

Publication date:
18/07/2018
JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-14082

Publication date:
18/07/2018
PHP Scripts Mall JOB SITE (aka Job Portal) 3.0.1 has Cross-site Scripting (XSS) via the search bar.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-7546

Publication date:
18/07/2018
wpsmain.dll in Kingsoft WPS Office 2016 and Jinshan PDF 10.1.0.6621 allows remote attackers to cause a denial of service via a crafted pdf file.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-10616

Publication date:
18/07/2018
ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-10877

Publication date:
18/07/2018
Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-14380

Publication date:
18/07/2018
In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-14381

Publication date:
18/07/2018
Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-14382

Publication date:
18/07/2018
InstantCMS 2.10.1 has /redirect?url= XSS.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8042

Publication date:
18/07/2018
Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-18103

Publication date:
18/07/2018
The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Browser through uploaded files that have a content-type of application/mathml+xml.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-8011

Publication date:
18/07/2018
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026