Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-45806

Publication date:

13/12/2024

Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2026

CVE-2022-43472

Publication date:

13/12/2024

Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2026

CVE-2024-48007

Publication date:

13/12/2024

Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit this vulnerability by gaining access to the source code, easily retrieving these secrets and reusing them to access the system leading to gaining access to unauthorized data.

Severity CVSS v4.0: Pending analysis

Last modification:

13/03/2025

CVE-2024-48008

Publication date:

13/12/2024

Dell RecoverPoint for Virtual Machines 6.0.x contains a OS Command Injection vulnerability. An Low privileged remote attacker could potentially exploit this vulnerability leading to information disclosure ,allowing of unintended actions like reading files that may contain sensitive information

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2025

CVE-2024-55889

Publication date:

13/12/2024

phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim&#39;s machine upon page visit by embedding it in an element without user interaction or explicit consent. Version 3.2.10 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

14/08/2025

CVE-2024-22461

Publication date:

13/12/2024

Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vulnerability by running any command as root, leading to gaining of root-level access and compromise of complete system.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2025

CVE-2024-38488

Publication date:

13/12/2024

Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attacker could potentially exploit this vulnerability, leading to a brute force attack or a dictionary attack against the RecoverPoint login form and a complete system compromise.<br /> This allows attackers to brute-force the password of valid users in an automated manner.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2025

CVE-2024-11986

Publication date:

13/12/2024

Improper input handling in the &#39;Host Header&#39; allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application&#39;s standard functionality, it enables the execution of the payload, resulting in Stored XSS or &#39;Cross-Site Scripting&#39;.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-9608

Publication date:

13/12/2024

The MyParcel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.24.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Please note this is only exploitable when the WooCommerce store is set to Belgium.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-11827

Publication date:

13/12/2024

The Out of the Block: OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s ootb_query shortcode in all versions up to, and including, 2.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-21576

Publication date:

13/12/2024

ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects a crafted string into the node. This can result in executing arbitrary code on the server.

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

CVE-2024-21577

Publication date:

13/12/2024

ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server.

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

Subscribe to Vulnerabilities