Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-15819
Publication date:
30/08/2019
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-15820
Publication date:
30/08/2019
The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-15821
Publication date:
30/08/2019
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-15822
Publication date:
30/08/2019
The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-15823
Publication date:
30/08/2019
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-15824
Publication date:
30/08/2019
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-15825
Publication date:
30/08/2019
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-5612
Publication date:
30/08/2019
In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe. A multi-threaded program can exploit races in the handler to copy out kernel memory outside the boundaries of midistat's data buffer.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-6113
Publication date:
30/08/2019
Directory traversal vulnerability on ONKYO TX-NR686 1030-5000-1040-0010 A/V Receiver devices allows remote attackers to read arbitrary files via a .. (dot dot) and %2f to the default URI.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-9697
Publication date:
30/08/2019
An information disclosure vulnerability in the Management Center (MC) REST API 2.0, 2.1, and 2.2 prior to 2.2.2.1 allows a malicious authenticated user to obtain passwords for external backup and CPL policy import servers that they might not otherwise be authorized to access.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-1966
Publication date:
30/08/2019
A vulnerability in a specific CLI command within the local management (local-mgmt) context for Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to gain elevated privileges as the root user on an affected device. The vulnerability is due to extraneous subcommand options present for a specific CLI command within the local-mgmt context. An attacker could exploit this vulnerability by authenticating to an affected device, entering the local-mgmt context, and issuing a specific CLI command and submitting user input. A successful exploit could allow the attacker to execute arbitrary operating system commands as root on an affected device. The attacker would need to have valid user credentials for the device.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-1967
Publication date:
30/08/2019
A vulnerability in the Network Time Protocol (NTP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to excessive use of system resources when the affected device is logging a drop action for received MODE_PRIVATE (Mode 7) NTP packets. An attacker could exploit this vulnerability by flooding the device with a steady stream of Mode 7 NTP packets. A successful exploit could allow the attacker to cause high CPU and memory usage on the affected device, which could cause internal system processes to restart or cause the affected device to unexpectedly reload. Note: The NTP feature is enabled by default.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026
Subscribe to Vulnerabilities