Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-25916

Publication date:

16/03/2021

Prototype pollution vulnerability in &#39;patchmerge&#39; versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2021-28543

Publication date:

16/03/2021

Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to install both Varnish Cache and varnish-modules. Specifically, an assertion failure or NULL pointer dereference can be triggered in Varnish Cache through the varnish-modules header.append() and header.copy() functions. For some Varnish Configuration Language (VCL) files, this gives remote clients an opportunity to cause a Varnish Cache restart. A restart reduces overall availability and performance due to an increased number of cache misses, and may cause higher load on backend servers.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-21192

Publication date:

16/03/2021

Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-21193

Publication date:

16/03/2021

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity CVSS v4.0: Pending analysis

Last modification:

24/10/2025

CVE-2020-24263

Publication date:

16/03/2021

Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host.

Severity CVSS v4.0: Pending analysis

Last modification:

23/03/2021

CVE-2020-24264

Publication date:

16/03/2021

Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine takeover.

Severity CVSS v4.0: Pending analysis

Last modification:

23/03/2021

CVE-2021-21191

Publication date:

16/03/2021

Use after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-4851

Publication date:

16/03/2021

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user to poison log files which could impact support and development efforts. IBM X-Force ID: 190450.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2021

CVE-2020-4891

Publication date:

16/03/2021

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could allow a local user er to brute force Rest API account credentials. IBM X-Force ID: 190974.

Severity CVSS v4.0: Pending analysis

Last modification:

22/03/2021

CVE-2020-4890

Publication date:

16/03/2021

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the REST API to cause a denial of service due to weak or absense of rate limiting. IBM X-Force ID: 190973.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2020-1926

Publication date:

16/03/2021

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8

Severity CVSS v4.0: Pending analysis

Last modification:

05/08/2022

CVE-2021-27230

Publication date:

15/03/2021

ExpressionEngine before 5.4.2 and 6.x before 6.0.3 allows PHP Code Injection by certain authenticated users who can leverage Translate::save() to write to an _lang.php file under the system/user/language directory.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

Subscribe to Vulnerabilities