Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-41265

Publication date:
01/08/2024
A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
Severity CVSS v4.0: Pending analysis
Last modification:
02/08/2024

CVE-2024-6040

Publication date:
01/08/2024
In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine.
Severity CVSS v4.0: Pending analysis
Last modification:
15/10/2025

CVE-2024-41260

Publication date:
01/08/2024
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
Severity CVSS v4.0: Pending analysis
Last modification:
15/12/2025

CVE-2024-41961

Publication date:
01/08/2024
Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in the live search functionality of the Ruby on Rails based Elektra web application. An authenticated user can craft a search term containing Ruby code, which later flows into an `eval` sink which executes the code. Fixed in commit 8bce00be93b95a6512ff68fe86bf9554e486bc02.
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2024

CVE-2024-41946

Publication date:
01/08/2024
REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull parser API. The REXML gem 3.3.3 or later include the patch to fix the vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41144

Publication date:
01/08/2024
Mattermost versions 9.9.x
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2024

CVE-2024-41162

Publication date:
01/08/2024
Mattermost versions 9.9.x
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2024

CVE-2024-41926

Publication date:
01/08/2024
Mattermost versions 9.9.x
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2024

CVE-2024-41123

Publication date:
01/08/2024
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-39839

Publication date:
01/08/2024
Mattermost versions 9.9.x
Severity CVSS v4.0: Pending analysis
Last modification:
04/09/2024

CVE-2024-39274

Publication date:
01/08/2024
Mattermost versions 9.9.x
Severity CVSS v4.0: Pending analysis
Last modification:
23/08/2024

CVE-2024-39777

Publication date:
01/08/2024
Mattermost versions 9.9.x
Severity CVSS v4.0: Pending analysis
Last modification:
23/08/2024