Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-25105

Publication date:

26/02/2023

A vulnerability, which was classified as problematic, was found in dro.pm. This affects an unknown part of the file web/fileman.php. The manipulation of the argument secret/key leads to cross site scripting. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named fa73c3a42bc5c246a1b8f815699ea241aef154bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221763.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2024

CVE-2021-3329

Publication date:

26/02/2023

Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack

Severity CVSS v4.0: Pending analysis

Last modification:

07/03/2023

CVE-2023-26091

Publication date:

26/02/2023

The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails.

Severity CVSS v4.0: Pending analysis

Last modification:

07/03/2023

CVE-2022-48362

Publication date:

25/02/2023

Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2025

CVE-2023-26550

Publication date:

25/02/2023

A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2025

CVE-2023-1035

Publication date:

25/02/2023

A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as critical. Affected is an unknown function of the file update_user.php. The manipulation of the argument user_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221784.

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2025

CVE-2022-2024

Publication date:

25/02/2023

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

Severity CVSS v4.0: Pending analysis

Last modification:

09/03/2023

CVE-2023-26104

Publication date:

25/02/2023

All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2025

CVE-2023-26103

Publication date:

25/02/2023

Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2025

CVE-2023-26544

Publication date:

25/02/2023

In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size.

Severity CVSS v4.0: Pending analysis

Last modification:

05/05/2025

CVE-2023-26545

Publication date:

25/02/2023

In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.

Severity CVSS v4.0: Pending analysis

Last modification:

25/06/2025

CVE-2023-26039

Publication date:

25/02/2023

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33.

Severity CVSS v4.0: Pending analysis

Last modification:

07/03/2023

Subscribe to Vulnerabilities