Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-37417
Publication date:
30/08/2021
Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.
Severity CVSS v4.0: Pending analysis
Last modification:
12/07/2022

CVE-2021-37421
Publication date:
30/08/2021
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
Severity CVSS v4.0: Pending analysis
Last modification:
12/07/2022

CVE-2021-38343
Publication date:
30/08/2021
The Nested Pages WordPress plugin
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2023

CVE-2021-38342
Publication date:
30/08/2021
The Nested Pages WordPress plugin
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2023

CVE-2021-29630
Publication date:
30/08/2021
In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code.
Severity CVSS v4.0: Pending analysis
Last modification:
14/12/2021

CVE-2021-34066
Publication date:
30/08/2021
An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file.
Severity CVSS v4.0: Pending analysis
Last modification:
07/09/2021

CVE-2021-36370
Publication date:
30/08/2021
An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity.
Severity CVSS v4.0: Pending analysis
Last modification:
08/09/2021

CVE-2021-34668
Publication date:
30/08/2021
The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1.
Severity CVSS v4.0: Pending analysis
Last modification:
04/02/2026

CVE-2021-37416
Publication date:
30/08/2021
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
Severity CVSS v4.0: Pending analysis
Last modification:
02/09/2021

CVE-2021-22021
Publication date:
30/08/2021
VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.
Severity CVSS v4.0: Pending analysis
Last modification:
02/09/2021

CVE-2021-33055
Publication date:
30/08/2021
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
Severity CVSS v4.0: Pending analysis
Last modification:
02/09/2021

CVE-2021-35061
Publication date:
30/08/2021
Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary web script or HTML via all parameters to HTML form fields in all components.
Severity CVSS v4.0: Pending analysis
Last modification:
21/09/2021
Subscribe to Vulnerabilities