Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-46259

Publication date:

01/10/2024

cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_unfilter() function at cute_png.h.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2024-46261

Publication date:

01/10/2024

cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_make32() function at cute_png.h.

Severity CVSS v4.0: Pending analysis

Last modification:

17/03/2025

CVE-2024-46263

Publication date:

01/10/2024

cute_png v1.05 was discovered to contain a stack overflow via the cp_dynamic() function at cute_png.h.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2024-41276

Publication date:

01/10/2024

A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to input a 6-digit PIN code sent to their email for authorization after entering their login credentials. However, the request limiting mechanism can be easily bypassed, enabling attackers to perform a brute force attack to guess the correct PIN and gain unauthorized access to the application.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2024

CVE-2023-7273

Publication date:

01/10/2024

Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests.<br /> If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing CSRF check is bypassed in this case. An attacker can, for example, create a new administrator account if the request is executed in the browser of an authenticated victim.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2024

CVE-2024-30132

Publication date:

01/10/2024

HCL Nomad server on Domino did not configure certain HTTP Security headers by default which could allow an attacker to obtain sensitive information via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2024-9405

Publication date:

01/10/2024

An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information from the server via the absolute path of a file located in the same directory or subdirectory as the module, but not from recursive directories.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2024

CVE-2024-9118

Publication date:

01/10/2024

The QS Dark Mode Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2024

CVE-2024-9060

Publication date:

01/10/2024

The AVIF & SVG Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in version 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

Severity CVSS v4.0: Pending analysis

Last modification:

04/10/2024

CVE-2023-3441

Publication date:

01/10/2024

An issue has been discovered in GitLab EE/CE affecting all versions starting from 8.0 before 16.4. The product did not sufficiently warn about security implications of granting merge rights to protected branches.

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2024

CVE-2024-9289

Publication date:

01/10/2024

The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user&#39;s identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator&#39;s email.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

CVE-2024-9241

Publication date:

01/10/2024

The PDF Image Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.5.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

Subscribe to Vulnerabilities