Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-8075

Publication date:

22/08/2024

A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the function setDiagnosisCfg. The manipulation leads to os command injection. The attack can be launched remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: MEDIUM

Last modification:

13/12/2024

CVE-2024-42418

Publication date:

22/08/2024

Avtec Outpost uses a default cryptographic key that can be used to decrypt sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

04/09/2024

CVE-2024-42599

Publication date:

22/08/2024

SeaCMS 13.0 has a remote code execution vulnerability. The reason for this vulnerability is that although admin_files.php imposes restrictions on edited files, attackers can still bypass these restrictions and write code, allowing authenticated attackers to exploit the vulnerability to execute arbitrary commands and gain system privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

28/03/2025

CVE-2024-39776

Publication date:

22/08/2024

Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.

Severity CVSS v4.0: Pending analysis

Last modification:

04/09/2024

CVE-2024-39717

Publication date:

22/08/2024

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2024-8088

Publication date:

22/08/2024

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

Severity CVSS v4.0: HIGH

Last modification:

03/11/2025

CVE-2024-42767

Publication date:

22/08/2024

Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2024-42773

Publication date:

22/08/2024

An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2024-7634

Publication date:

22/08/2024

NGINX Agent&#39;s "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory.

Severity CVSS v4.0: MEDIUM

Last modification:

24/01/2025

CVE-2024-42772

Publication date:

22/08/2024

An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to view valid hotel room entries in administrator section.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2024-42774

Publication date:

22/08/2024

An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to delete valid hotel room entries in the administrator section.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

CVE-2024-42775

Publication date:

22/08/2024

An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access.

Severity CVSS v4.0: Pending analysis

Last modification:

30/04/2025

Subscribe to Vulnerabilities