Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-34250
Publication date:
11/04/2022
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2021-33396. Reason: This record is a duplicate of CVE-2021-33396. Notes: All CVE users should reference CVE-2021-33396 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-0828
Publication date:
11/04/2022
The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.
Severity CVSS v4.0: Pending analysis
Last modification:
21/03/2025

CVE-2021-24986
Publication date:
11/04/2022
The Post Grid WordPress plugin before 2.1.16 does not escape the keyword parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in pages containing a Post Grid with a search form
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2021-24987
Publication date:
11/04/2022
The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.30 does not sanitise and escape the urls parameter in its the_champ_sharing_count AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-27041
Publication date:
11/04/2022
Due to lack of protection, parameter student_id in OpenSIS Classic 8.0 /modules/eligibility/Student.php can be used to inject SQL queries to extract information from databases.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-27088
Publication date:
11/04/2022
Ivanti DSM Remote
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-27089
Publication date:
11/04/2022
In Fujitsu PlugFree Network
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-26413
Publication date:
11/04/2022
A command injection vulnerability in the CGI program of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0 could allow a local authenticated attacker to execute arbitrary OS commands on a vulnerable device via a LAN interface.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-26414
Publication date:
11/04/2022
A potential buffer overflow vulnerability was identified in some internal functions of Zyxel VMG3312-T20A firmware version 5.30(ABFX.5)C0, which could be exploited by a local authenticated attacker to cause a denial of service.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-1296
Publication date:
11/04/2022
Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-1297
Publication date:
11/04/2022
Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022

CVE-2022-1295
Publication date:
11/04/2022
Prototype Pollution in GitHub repository alvarotrigo/fullpage.js prior to 4.0.2.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2022
Subscribe to Vulnerabilities