Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-47524

Publication date:

01/10/2024

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly sanitize the user input in the Device Groups name, when user see the detail of the Device Group, if java script code is inside the name of the Device Groups, its will be trigger. This vulnerability is fixed in 24.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2024

CVE-2024-47525

Publication date:

01/10/2024

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users&#39; sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

CVE-2024-47526

Publication date:

01/10/2024

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" feature allows users to inject arbitrary JavaScript into the alert template&#39;s name. This script executes immediately upon submission but does not persist after a page refresh.

Severity CVSS v4.0: Pending analysis

Last modification:

19/12/2024

CVE-2024-47527

Publication date:

01/10/2024

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the device name ("hostname" parameter). This vulnerability can lead to the execution of malicious code in the context of other users&#39; sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

CVE-2024-46080

Publication date:

01/10/2024

Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2025

CVE-2024-46082

Publication date:

01/10/2024

Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2025

CVE-2024-46084

Publication date:

01/10/2024

Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2025

CVE-2024-45999

Publication date:

01/10/2024

A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /application/models/Oqrs_model.php. The vulnerability is exploitable via the station_id parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

CVE-2024-9411

Publication date:

01/10/2024

A vulnerability classified as problematic has been found in OFCMS 1.1.2. This affects the function add of the file /admin/system/dict/add.json?sqlid=system.dict.save. The manipulation of the argument dict_value leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

13/11/2025

CVE-2024-9341

Publication date:

01/10/2024

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2024

CVE-2024-9355

Publication date:

01/10/2024

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.

Severity CVSS v4.0: Pending analysis

Last modification:

02/10/2025

CVE-2024-46083

Publication date:

01/10/2024

Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). An authenticated user can craft malicious payloads using the messages feature, which allows the injection of malicious code into any user&#39;s account on the platform. It is important to note that regular users can trigger actions for administrator users.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2025

Subscribe to Vulnerabilities