Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-24623
Publication date:
30/01/2023
Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2025

CVE-2023-24622
Publication date:
30/01/2023
isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2025

CVE-2022-25967
Publication date:
30/01/2023
Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API.<br /> <br /> **Note:** This is exploitable only for users who are rendering templates with user-defined data.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
27/03/2025

CVE-2022-25936
Publication date:
30/01/2023
Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
27/03/2025

CVE-2022-48303
Publication date:
30/01/2023
GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.
Severity CVSS v4.0: Pending analysis
Last modification:
27/03/2025

CVE-2023-24612
Publication date:
30/01/2023
The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2025

CVE-2022-27596
Publication date:
30/01/2023
A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code.<br /> We have already fixed this vulnerability in the following versions of QuTS hero, QTS:<br /> QuTS hero h5.0.1.2248 build 20221215 and later<br /> QTS 5.0.1.2234 build 20221201 and later<br />
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-46873
Publication date:
29/01/2023
WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim&amp;#39;s system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2025

CVE-2023-0572
Publication date:
29/01/2023
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2023

CVE-2023-24065
Publication date:
29/01/2023
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for health charting.
Severity CVSS v4.0: Pending analysis
Last modification:
28/03/2025

CVE-2023-0565
Publication date:
29/01/2023
Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2023

CVE-2023-0566
Publication date:
29/01/2023
Improper Neutralization of Input During Web Page Generation (&amp;#39;Cross-site Scripting&amp;#39;) in froxlor/froxlor prior to 2.0.10.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2023
Subscribe to Vulnerabilities