Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-30586

Publication date:

01/07/2023

A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto.setEngine() API can be used to bypass the permission model when called with a compatible OpenSSL engine. The OpenSSL engine can, for example, disable the permission model in the host process by manipulating the process&#39;s stack memory to locate the permission model Permission::enabled_ in the host process&#39;s heap memory. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Severity CVSS v4.0: Pending analysis

Last modification:

08/05/2025

CVE-2023-30589

Publication date:

01/07/2023

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2021-34506

Publication date:

01/07/2023

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

18/08/2023

CVE-2023-22814

Publication date:

01/07/2023

An authentication bypass issue via spoofing was discovered in the token-based authentication mechanism that could allow an attacker to carry out an impersonation attack. This issue affects My Cloud OS 5 devices: before 5.26.202.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2023

CVE-2021-31982

Publication date:

01/07/2023

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2025

CVE-2021-42307

Publication date:

01/07/2023

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2023

CVE-2021-34475

Publication date:

01/07/2023

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2023

CVE-2023-36812

Publication date:

30/06/2023

OpenTSDB is a open source, distributed, scalable Time Series Database (TSDB). OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit `07c4641471c` and further refined in commit `fa88d3e4b`. These patches are available in the `2.4.2` release. Users are advised to upgrade. User unable to upgrade may disable Gunuplot via the config option`tsd.core.enable_ui = true` and remove the shell files `mygnuplot.bat` and `mygnuplot.sh`.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2023

CVE-2023-36144

Publication date:

30/06/2023

An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.

Severity CVSS v4.0: Pending analysis

Last modification:

10/07/2023

CVE-2023-3338

Publication date:

30/06/2023

A null pointer dereference flaw was found in the Linux kernel&#39;s DECnet networking protocol. This issue could allow a remote user to crash the system.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023