Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2018-10920

Publication date:

02/08/2018

Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache.

Severity CVSS v4.0: Pending analysis

Last modification:

18/02/2020

CVE-2018-12448

Publication date:

02/08/2018

Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser&#39;s address bar when visiting a non-http page, which allows an attacker to display a malicious web page with a fake domain name.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2019

CVE-2018-8032

Publication date:

02/08/2018

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.

Severity CVSS v4.0: Pending analysis

Last modification:

08/05/2025

CVE-2018-2933

Publication date:

02/08/2018

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. Note: Please refer to MOS document

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-3108

Publication date:

02/08/2018

Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Notification Service). Supported versions that are affected are 12.2.1.2 and 12.2.1.3. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Fusion Middleware. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Fusion Middleware accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-3109

Publication date:

02/08/2018

Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported versions that are affected are 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Fusion Middleware MapViewer. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Fusion Middleware MapViewer accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2018-14847

Publication date:

02/08/2018

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

CVE-2018-14838

Publication date:

02/08/2018

rejucms 2.1 has stored XSS via the admin/book.php content parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2018

CVE-2018-14840

Publication date:

02/08/2018

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).

Severity CVSS v4.0: Pending analysis

Last modification:

08/11/2018

CVE-2018-14835

Publication date:

02/08/2018

Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.

Severity CVSS v4.0: Pending analysis

Last modification:

28/09/2018

CVE-2018-14836

Publication date:

02/08/2018

Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions) if the Guests user group has access to the Admin panel.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2019

CVE-2015-9262

Publication date:

01/08/2018

_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.

Severity CVSS v4.0: Pending analysis

Last modification:

16/04/2019

Subscribe to Vulnerabilities