Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-7743

Publication date:

12/02/2019

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-7744

Publication date:

12/02/2019

An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2018-20781

Publication date:

12/02/2019

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user&#39;s password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-6527

Publication date:

12/02/2019

PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) may allow an attacker to be able to change the password for an admin user who is currently or previously logged in, provided the device has not been restarted.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-6533

Publication date:

12/02/2019

Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166).

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-7753

Publication date:

12/02/2019

Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-5595

Publication date:

12/02/2019

In FreeBSD before 11.2-STABLE(r343782), 11.2-RELEASE-p9, 12.0-STABLE(r343781), and 12.0-RELEASE-p3, kernel callee-save registers are not properly sanitized before return from system calls, potentially allowing some kernel data used in the system call to be exposed.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-5596

Publication date:

12/02/2019

In FreeBSD 11.2-STABLE after r338618 and before r343786, 12.0-STABLE before r343781, and 12.0-RELEASE before 12.0-RELEASE-p3, a bug in the reference count implementation for UNIX domain sockets can cause a file structure to be incorrectly released potentially allowing a malicious local user to gain root privileges or escape from a jail.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2019-3923

Publication date:

12/02/2019

Nessus versions 8.2.1 and earlier were found to contain a stored XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote attacker could potentially exploit this vulnerability via a specially crafted request to execute arbitrary script code in a user&#39;s browser session. Tenable has released Nessus 8.2.2 to address this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2018-9582

Publication date:

11/02/2019

In package installer in Android-8.0, Android-8.1 and Android-9, there is a possible bypass of the unknown source warning due to a confused deputy scenario. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-112031362.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2018-9583

Publication date:

11/02/2019

In bta_ag_parse_cmer of bta_ag_cmd.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution in the bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-112860487.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2018-9584

Publication date:

11/02/2019

In nfc_ncif_set_config_status of nfc_ncif.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-114047681.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

Subscribe to Vulnerabilities