Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-31973

Publication date:

30/10/2024

Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the &#39;Network Name (SSID)&#39; input fields to the /index.html#wireless_basic page.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2024

CVE-2024-31975

Publication date:

30/10/2024

EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vulnerable field is executed when the user clicks the SSID field&#39;s corresponding EDIT button.

Severity CVSS v4.0: Pending analysis

Last modification:

26/01/2026

CVE-2024-10456

Publication date:

30/10/2024

Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication.

Severity CVSS v4.0: CRITICAL

Last modification:

01/11/2024

CVE-2024-9110

Publication date:

30/10/2024

A medium severity vulnerability has been identified within Privileged Identity which can allow an attacker to perform reflected cross-site scripting attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2025

CVE-2024-51258

Publication date:

30/10/2024

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function.

Severity CVSS v4.0: Pending analysis

Last modification:

10/04/2025

CVE-2024-50344

Publication date:

30/10/2024

I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2024

CVE-2024-50419

Publication date:

30/10/2024

Incorrect Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Greenshift: from n/a through

Severity CVSS v4.0: Pending analysis

Last modification:

01/04/2026

CVE-2024-51296

Publication date:

30/10/2024

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function.

Severity CVSS v4.0: Pending analysis

Last modification:

10/04/2025

CVE-2024-51299

Publication date:

30/10/2024

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function.

Severity CVSS v4.0: Pending analysis

Last modification:

10/04/2025

CVE-2024-51300

Publication date:

30/10/2024

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function.

Severity CVSS v4.0: Pending analysis

Last modification:

10/04/2025

CVE-2024-51301

Publication date:

30/10/2024

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function.

Severity CVSS v4.0: Pending analysis

Last modification:

10/04/2025

CVE-2024-51257

Publication date:

30/10/2024

DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function.

Severity CVSS v4.0: Pending analysis

Last modification:

10/04/2025

Subscribe to Vulnerabilities