Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-38430
Publication date:
30/07/2024
Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity CVSS v4.0: Pending analysis
Last modification:
06/09/2024

CVE-2024-38431
Publication date:
30/07/2024
Matrix Tafnit v8<br /> <br /> - <br /> <br /> CWE-204: Observable Response Discrepancy
Severity CVSS v4.0: Pending analysis
Last modification:
06/09/2024

CVE-2024-38432
Publication date:
30/07/2024
Matrix Tafnit v8<br /> <br /> - <br /> <br /> <br /> <br /> CWE-646: Reliance on File Name or Extension of Externally-Supplied File
Severity CVSS v4.0: Pending analysis
Last modification:
06/09/2024

CVE-2024-40895
Publication date:
30/07/2024
FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the executable file path is set to a batch file (.bat) or command file (.cmd) extension.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2023-48396
Publication date:
30/07/2024
Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge<br /> any token to log in any user.<br /> <br /> Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token.<br /> This issue affects Apache SeaTunnel: 1.0.0.<br /> <br /> Users are recommended to upgrade to version 1.0.1, which fixes the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
10/07/2025

CVE-2024-38429
Publication date:
30/07/2024
Matrix Tafnit v8<br /> <br /> -  CWE-552: Files or Directories Accessible to External Parties
Severity CVSS v4.0: Pending analysis
Last modification:
06/09/2024

CVE-2024-42229
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: aead,cipher - zeroize key buffer after use<br /> <br /> I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding<br /> cryptographic information should be zeroized once they are no longer<br /> needed. Accomplish this by using kfree_sensitive for buffers that<br /> previously held the private key.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-42230
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc/pseries: Fix scv instruction crash with kexec<br /> <br /> kexec on pseries disables AIL (reloc_on_exc), required for scv<br /> instruction support, before other CPUs have been shut down. This means<br /> they can execute scv instructions after AIL is disabled, which causes an<br /> interrupt at an unexpected entry location that crashes the kernel.<br /> <br /> Change the kexec sequence to disable AIL after other CPUs have been<br /> brought down.<br /> <br /> As a refresher, the real-mode scv interrupt vector is 0x17000, and the<br /> fixed-location head code probably couldn&amp;#39;t easily deal with implementing<br /> such high addresses so it was just decided not to support that interrupt<br /> at all.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-42231
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: zoned: fix calc_available_free_space() for zoned mode<br /> <br /> calc_available_free_space() returns the total size of metadata (or<br /> system) block groups, which can be allocated from unallocated disk<br /> space. The logic is wrong on zoned mode in two places.<br /> <br /> First, the calculation of data_chunk_size is wrong. We always allocate<br /> one zone as one chunk, and no partial allocation of a zone. So, we<br /> should use zone_size (= data_sinfo-&gt;chunk_size) as it is.<br /> <br /> Second, the result "avail" may not be zone aligned. Since we always<br /> allocate one zone as one chunk on zoned mode, returning non-zone size<br /> aligned bytes will result in less pressure on the async metadata reclaim<br /> process.<br /> <br /> This is serious for the nearly full state with a large zone size device.<br /> Allowing over-commit too much will result in less async reclaim work and<br /> end up in ENOSPC. We can align down to the zone size to avoid that.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2024

CVE-2024-7223
Publication date:
30/07/2024
A vulnerability has been found in SourceCodester Lot Reservation Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /view_model.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272803.
Severity CVSS v4.0: Pending analysis
Last modification:
23/08/2024

CVE-2024-7224
Publication date:
30/07/2024
A vulnerability was found in SourceCodester Lot Reservation Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /lot_details.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272804.
Severity CVSS v4.0: Pending analysis
Last modification:
23/08/2024

CVE-2024-42155
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/pkey: Wipe copies of protected- and secure-keys<br /> <br /> Although the clear-key of neither protected- nor secure-keys is<br /> accessible, this key material should only be visible to the calling<br /> process. So wipe all copies of protected- or secure-keys from stack,<br /> even in case of an error.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2024
Subscribe to Vulnerabilities