Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2017-15809

Publication date:
23/10/2017
In phpMyFaq before 2.9.9, there is XSS in admin/tags.main.php via a crafted tag.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-15810

Publication date:
23/10/2017
The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-15811

Publication date:
23/10/2017
The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-15812

Publication date:
23/10/2017
The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2016-10516

Publication date:
23/10/2017
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2010-2232

Publication date:
23/10/2017
In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.
Severity CVSS v4.0: Pending analysis
Last modification:
13/05/2026

CVE-2017-14327

Publication date:
23/10/2017
Extreme EXOS 16.x, 21.x, and 22.x allows administrators to read arbitrary files.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-14328

Publication date:
23/10/2017
Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-14329

Publication date:
23/10/2017
Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shell.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-14330

Publication date:
23/10/2017
Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving a privileged process.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-14331

Publication date:
23/10/2017
Extreme EXOS 16.x, 21.x, and 22.x allows administrators to bypass the "exsh restricted shell" protection mechanism and obtain an interactive shell.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2017-14332

Publication date:
23/10/2017
Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026