Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-46842
Publication date:
16/05/2024
Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and<br /> other modes. This in particular means that they may set registers used<br /> to pass 32-bit-mode hypercall arguments to values outside of the range<br /> 32-bit code would be able to set them to.<br /> <br /> When processing of hypercalls takes a considerable amount of time,<br /> the hypervisor may choose to invoke a hypercall continuation. Doing so<br /> involves putting (perhaps updated) hypercall arguments in respective<br /> registers. For guests not running in 64-bit mode this further involves<br /> a certain amount of translation of the values.<br /> <br /> Unfortunately internal sanity checking of these translated values<br /> assumes high halves of registers to always be clear when invoking a<br /> hypercall. When this is found not to be the case, it triggers a<br /> consistency check in the hypervisor and causes a crash.<br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/01/2026

CVE-2024-20326
Publication date:
16/05/2024
A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system.<br /> <br /> <br /> This vulnerability is due to improper authorization enforcement when specific CLI commands are used. An attacker could exploit this vulnerability by executing an affected CLI command with crafted arguments. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system with the privileges of the root user.
Severity CVSS v4.0: Pending analysis
Last modification:
25/07/2025

CVE-2024-20389
Publication date:
16/05/2024
A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system.<br /> <br /> <br /> This vulnerability is due to improper authorization enforcement when specific CLI commands are used. An attacker could exploit this vulnerability by executing an affected CLI command with crafted arguments. A successful exploit could allow the attacker to read or write arbitrary files on the underlying operating system with the privileges of the root user.
Severity CVSS v4.0: Pending analysis
Last modification:
30/07/2025

CVE-2024-31142
Publication date:
16/05/2024
Because of a logical error in XSA-407 (Branch Type Confusion), the<br /> mitigation is not applied properly when it is intended to be used.<br /> XSA-434 (Speculative Return Stack Overflow) uses the same<br /> infrastructure, so is equally impacted.<br /> <br /> For more details, see:<br /> https://xenbits.xen.org/xsa/advisory-407.html<br /> https://xenbits.xen.org/xsa/advisory-434.html<br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/01/2026

CVE-2024-4999
Publication date:
16/05/2024
A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352.
Severity CVSS v4.0: CRITICAL
Last modification:
15/04/2026

CVE-2024-4760
Publication date:
16/05/2024
A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2024-4993
Publication date:
16/05/2024
Vulnerability in SiAdmin 1.1 that allows XSS via the /show.php query parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and thereby steal their cookie session credentials.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2025

CVE-2024-4991
Publication date:
16/05/2024
Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_pass/aksi_pass.php parameter in nama_lengkap. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2025

CVE-2024-4992
Publication date:
16/05/2024
Vulnerability in SiAdmin 1.1 that allows SQL injection via the /modul/mod_kuliah/aksi_kuliah.php parameter in nim. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in it.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2025

CVE-2024-4826
Publication date:
16/05/2024
SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all the information stored in the database by sending a specially crafted SQL query, due to the lack of proper sanitisation of the category_id parameter in the category.php file.
Severity CVSS v4.0: CRITICAL
Last modification:
15/04/2026

CVE-2024-30314
Publication date:
16/05/2024
Dreamweaver Desktop versions 21.3 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command (&amp;#39;OS Command Injection&amp;#39;) vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does require user interaction.
Severity CVSS v4.0: Pending analysis
Last modification:
12/12/2024

CVE-2024-4580
Publication date:
16/05/2024
The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-35702 is likely a duplicate of this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
08/04/2026
Subscribe to Vulnerabilities