Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-22570

Publication date:

01/04/2022

A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and earlier) allows a malicious actor who has gained access to a network to control all connected UA devices. This vulnerability is fixed in Version 3.8.31.13 and later.

Severity CVSS v4.0: Pending analysis

Last modification:

09/04/2022

CVE-2022-21830

Publication date:

01/04/2022

A blind self XSS vulnerability exists in RocketChat LiveChat

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-22965

Publication date:

01/04/2022

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2022-22963

Publication date:

01/04/2022

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2022-22950

Publication date:

01/04/2022

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

Severity CVSS v4.0: Pending analysis

Last modification:

22/06/2022

CVE-2022-1018

Publication date:

01/04/2022

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

12/04/2022

CVE-2022-1068

Publication date:

01/04/2022

Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.

Severity CVSS v4.0: Pending analysis

Last modification:

12/04/2022

CVE-2022-1159

Publication date:

01/04/2022

Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-1098

Publication date:

01/04/2022

Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissions vulnerability of 4.2.2 above, this makes it possible for an attacker to escalate privileges

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2022

CVE-2022-0922

Publication date:

01/04/2022

The software does not perform any authentication for critical system functionality.

Severity CVSS v4.0: Pending analysis

Last modification:

12/04/2022

CVE-2022-0425

Publication date:

01/04/2022

A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

12/04/2022

CVE-2022-0489

Publication date:

01/04/2022

An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments.

Severity CVSS v4.0: Pending analysis

Last modification:

13/04/2022

Subscribe to Vulnerabilities