Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-30170

Publication date:
06/08/2024
PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2024

CVE-2023-40819

Publication date:
06/08/2024
ID4Portais in version
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2024

CVE-2024-33897

Publication date:
06/08/2024
A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2024

CVE-2024-7519

Publication date:
06/08/2024
Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2024

CVE-2024-7520

Publication date:
06/08/2024
A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
24/03/2025

CVE-2024-7522

Publication date:
06/08/2024
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2024

CVE-2024-7523

Publication date:
06/08/2024
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. <br /> *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
14/03/2025

CVE-2024-7524

Publication date:
06/08/2024
Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
25/03/2025

CVE-2024-7525

Publication date:
06/08/2024
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2024

CVE-2024-7526

Publication date:
06/08/2024
ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
17/09/2024

CVE-2024-7527

Publication date:
06/08/2024
Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
18/03/2025

CVE-2024-7528

Publication date:
06/08/2024
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox
Severity CVSS v4.0: Pending analysis
Last modification:
12/08/2024