Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-12601
Publication date:
07/06/2019
SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3).
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-10160
Publication date:
07/06/2019
A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-3477
Publication date:
07/06/2019
Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19999
Publication date:
07/06/2019
The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls that permit local users to bypass authentication in the application and execute code in the context of the Windows SYSTEM account, leading to privilege escalation. To exploit this vulnerability, an attacker must have local access the the host running Serv-U, and a Serv-U administrator have an active management console session.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19800
Publication date:
07/06/2019
aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19801
Publication date:
07/06/2019
aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19802
Publication date:
07/06/2019
aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19860
Publication date:
07/06/2019
Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices does not properly restrict LMP commnds and executes certain memory contents upon receiving an LMP command, as demonstrated by executing an HCI command.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19451
Publication date:
07/06/2019
A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19452
Publication date:
07/06/2019
A use after free in the TextBox field Mouse Enter action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444, this has a different free location and requires different JavaScript code for exploitation.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19461
Publication date:
07/06/2019
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2018-19462
Publication date:
07/06/2019
admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026
Subscribe to Vulnerabilities