Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-48307

Publication date:
31/10/2024
JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.
Severity CVSS v4.0: Pending analysis
Last modification:
27/06/2025

CVE-2024-10006

Publication date:
30/10/2024
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.
Severity CVSS v4.0: Pending analysis
Last modification:
10/01/2025

CVE-2024-10086

Publication date:
30/10/2024
A vulnerability was identified in Consul and Consul Enterprise such that the server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and lead to reflected XSS.
Severity CVSS v4.0: Pending analysis
Last modification:
10/01/2025

CVE-2024-10005

Publication date:
30/10/2024
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using URL paths in L7 traffic intentions could bypass HTTP request path-based access rules.
Severity CVSS v4.0: Pending analysis
Last modification:
10/01/2025

CVE-2024-51425

Publication date:
30/10/2024
An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is disputed by third parties because the impact is limited to function calls.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-51426

Publication date:
30/10/2024
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer function. NOTE: this is disputed by third parties because the impact is limited to function calls.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-51427

Publication date:
30/10/2024
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2023-52066

Publication date:
30/10/2024
http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter.
Severity CVSS v4.0: Pending analysis
Last modification:
04/11/2024

CVE-2024-43382

Publication date:
30/10/2024
Snowflake JDBC driver versions >= 3.2.6 and
Severity CVSS v4.0: Pending analysis
Last modification:
20/08/2025

CVE-2024-48093

Publication date:
30/10/2024
Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading and executing malicious files without validating file extensions or content types.
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024

CVE-2024-48112

Publication date:
30/10/2024
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2025

CVE-2024-48346

Publication date:
30/10/2024
xtreme1
Severity CVSS v4.0: Pending analysis
Last modification:
01/11/2024