Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-9950
Publication date:
02/01/2025
A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows <br /> <br /> unauthenticated user to modify compliance scripts due to insecure temporary directory.
Severity CVSS v4.0: HIGH
Last modification:
02/01/2025

CVE-2024-12907
Publication date:
02/01/2025
Kentico CMS in version 7 is vulnerable to a Reflected XSS attacks through manipulation of a specific GET request parameter sent to /CMSMessages/AccessDenied.aspx endpoint.<br /> Notably, support for this version of Kentico ended in 2016. Version 8 was tested as well and does not contain this vulnerability.
Severity CVSS v4.0: MEDIUM
Last modification:
02/01/2025

CVE-2024-55540
Publication date:
02/01/2025
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169.
Severity CVSS v4.0: Pending analysis
Last modification:
02/01/2025

CVE-2024-55541
Publication date:
02/01/2025
Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39169.
Severity CVSS v4.0: Pending analysis
Last modification:
02/01/2025

CVE-2023-23672
Publication date:
02/01/2025
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.
Severity CVSS v4.0: Pending analysis
Last modification:
25/02/2025

CVE-2022-45811
Publication date:
02/01/2025
Missing Authorization vulnerability in WeyHan Ng Post Teaser.This issue affects Post Teaser: from n/a through 4.1.5.
Severity CVSS v4.0: Pending analysis
Last modification:
02/01/2025

CVE-2022-47601
Publication date:
02/01/2025
Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Table Manager: from n/a through 3.5.2.
Severity CVSS v4.0: Pending analysis
Last modification:
02/01/2025

CVE-2025-0171
Publication date:
02/01/2025
A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /admin/deleteuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
03/04/2025

CVE-2024-56137
Publication date:
02/01/2025
MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to execute OS command in custom scripts. The vulnerability has been fixed in v1.9.0.
Severity CVSS v4.0: Pending analysis
Last modification:
02/01/2025

CVE-2024-49385
Publication date:
02/01/2025
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis True Image (Windows) before build 41736.
Severity CVSS v4.0: Pending analysis
Last modification:
02/01/2025

CVE-2024-55538
Publication date:
02/01/2025
Sensitive information disclosure due to missing authentication. The following products are affected: Acronis True Image (macOS) before build 41725, Acronis True Image (Windows) before build 41736.
Severity CVSS v4.0: Pending analysis
Last modification:
02/01/2025

CVE-2023-47778
Publication date:
02/01/2025
Missing Authorization vulnerability in LuckyWP LuckyWP Scripts Control allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LuckyWP Scripts Control: from n/a through 1.2.1.
Severity CVSS v4.0: Pending analysis
Last modification:
02/01/2025
Subscribe to Vulnerabilities