Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-9917

Publication date:
27/03/2019
ZNC before 1.7.3-rc1 allows an existing remote user to cause a Denial of Service (crash) via invalid encoding.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-10118

Publication date:
27/03/2019
Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2016-10744

Publication date:
27/03/2019
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-7167

Publication date:
27/03/2019
Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a consistency check, and consequently transform the proof of one statement into an ostensibly valid proof of a different statement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into accepting the correctness of a transaction.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-1571

Publication date:
26/03/2019
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server settings.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-10105

Publication date:
26/03/2019
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-10106

Publication date:
26/03/2019
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-10107

Publication date:
26/03/2019
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-1569

Publication date:
26/03/2019
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings for account name of admin user.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-1570

Publication date:
26/03/2019
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-1572

Publication date:
26/03/2019
PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-6569

Publication date:
26/03/2019
The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could use this behavior to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behavior.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026