Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-13448

Publication date:

28/01/2025

The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the &#39;trx_addons_uploads_save_data&#39; function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2025

CVE-2024-12723

Publication date:

28/01/2025

The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Severity CVSS v4.0: Pending analysis

Last modification:

24/05/2025

CVE-2024-12807

Publication date:

28/01/2025

The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Severity CVSS v4.0: Pending analysis

Last modification:

11/05/2025

CVE-2025-24810

Publication date:

28/01/2025

Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2025-23084

Publication date:

28/01/2025

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory.<br /> <br /> On Windows, a path that does not start with the file separator is treated as relative to the current directory. <br /> <br /> This vulnerability affects Windows users of `path.join` API.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2024-11135

Publication date:

28/01/2025

The Eventer plugin for WordPress is vulnerable to SQL Injection via the &#39;event&#39; parameter in the &#39;eventer_get_attendees&#39; function in all versions up to, and including, 3.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2025

CVE-2024-53869

Publication date:

28/01/2025

NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability might lead to information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2024-53881

Publication date:

28/01/2025

NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which may lead to denial of service.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2024-0146

Publication date:

28/01/2025

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2024-0147

Publication date:

28/01/2025

NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial of service or data tampering.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

CVE-2024-0149

Publication date:

28/01/2025

NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerability might lead to limited information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

27/03/2025

CVE-2024-0150

Publication date:

28/01/2025

NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful exploit of this vulnerability might lead to information disclosure, denial of service, or data tampering.

Severity CVSS v4.0: Pending analysis

Last modification:

28/01/2025

Subscribe to Vulnerabilities