Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-13614
Publication date:
06/02/2025
Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Light Agent, Kaspersky Endpoint Security for Windows, Kaspersky Small Office Security, Kaspersky for Windows (Standard, Plus, Premium), Kaspersky Free, Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Security Cloud, Kaspersky Safe Kids, Kaspersky Anti-Ransomware Tool that could allow an authenticated attacker to write data to a limited area outside the allocated kernel memory buffer. The fix was installed automatically for all Kaspersky Endpoint products.
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2025

CVE-2024-39033
Publication date:
06/02/2025
In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolen.
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2025

CVE-2024-39272
Publication date:
06/02/2025
A cross-site scripting (xss) vulnerability exists in the dataset upload functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to an arbitrary html code. An attacker can send a series of HTTP requests to trigger this vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
05/09/2025

CVE-2022-40490
Publication date:
06/02/2025
Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the name of an uploaded or already existing file.
Severity CVSS v4.0: Pending analysis
Last modification:
31/12/2025

CVE-2022-40916
Publication date:
06/02/2025
Tiny File Manager v2.4.7 and below is vulnerable to session fixation.
Severity CVSS v4.0: Pending analysis
Last modification:
31/12/2025

CVE-2025-0994
Publication date:
06/02/2025
Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer’s Microsoft Internet Information Services (IIS) web server.
Severity CVSS v4.0: HIGH
Last modification:
30/10/2025

CVE-2024-43811
Publication date:
06/02/2025
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2024. Notes: none.
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2025

CVE-2023-5878
Publication date:
06/02/2025
Honeywell OneWireless <br /> <br /> Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command injection vulnerability. An attacker who is authenticated could use the firmware update process to potentially exploit the vulnerability, leading to a command injection. Honeywell recommends updating to <br /> <br /> R322.3, R330.2 or the most recent version of this product2.
Severity CVSS v4.0: CRITICAL
Last modification:
18/02/2025

CVE-2022-31764
Publication date:
06/02/2025
The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2.<br /> The premise of this attack is that the attacker has obtained the account and password. Otherwise, the attacker cannot perform this attack.
Severity CVSS v4.0: Pending analysis
Last modification:
16/07/2025

CVE-2025-1074
Publication date:
06/02/2025
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it.
Severity CVSS v4.0: MEDIUM
Last modification:
02/07/2025

CVE-2025-1076
Publication date:
06/02/2025
A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality.
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2025

CVE-2024-24911
Publication date:
06/02/2025
In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpca process is down, VPN and SIC connectivity issues may occur if the CRL is not present in the Security Gateway&amp;#39;s CRL cache.
Severity CVSS v4.0: Pending analysis
Last modification:
15/10/2025
Subscribe to Vulnerabilities