Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-35141
Publication date:
19/12/2024
IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-30443
Publication date:
19/12/2024
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query.
Severity CVSS v4.0: Pending analysis
Last modification:
31/01/2025

CVE-2024-10548
Publication date:
19/12/2024
The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the hashed passwords of project owners (e.g. adminstrators).
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2025

CVE-2023-23357
Publication date:
19/12/2024
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QuLog Center 1.5.0.738 ( 2023/03/06 ) and later<br /> QuLog Center 1.4.1.691 ( 2023/03/01 ) and later<br /> QuLog Center 1.3.1.645 ( 2023/02/22 ) and later
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2024

CVE-2024-12121
Publication date:
19/12/2024
The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the &amp;#39;moblc_check_link&amp;#39; function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2024

CVE-2022-27595
Publication date:
19/12/2024
An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QVPN Windows 2.0.0.1316 and later<br /> QVPN Windows 2.0.0.1310 and later
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2024

CVE-2022-27600
Publication date:
19/12/2024
An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QTS 5.0.1.2277 and later<br /> QTS 4.5.4.2280 build 20230112 and later<br /> QuTS hero h5.0.1.2277 build 20230112 and later<br /> QuTS hero h4.5.4.2374 build 20230417 and later<br /> QuTScloud c5.0.1.2374 and later
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2024

CVE-2023-23354
Publication date:
19/12/2024
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QuLog Center 1.5.0.738 ( 2023/03/06 ) and later<br /> QuLog Center 1.4.1.691 ( 2023/03/01 ) and later<br /> QuLog Center 1.3.1.645 ( 2023/02/22 ) and later
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2024

CVE-2023-23356
Publication date:
19/12/2024
A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QuFirewall 2.3.3 ( 2023/03/27 ) and later<br /> and later
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2024

CVE-2022-33954
Publication date:
19/12/2024
IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 could allow a user with psychical access to the system to obtain sensitive information due to insufficiently protected credentials.
Severity CVSS v4.0: Pending analysis
Last modification:
27/03/2025

CVE-2021-39081
Publication date:
19/12/2024
IBM Cognos Analytics Mobile for Android 1.1.14 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Severity CVSS v4.0: Pending analysis
Last modification:
29/07/2025

CVE-2023-21586
Publication date:
19/12/2024
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2025
Subscribe to Vulnerabilities