Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-45373

Publication date:

25/09/2024

Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2024

CVE-2024-43423

Publication date:

25/09/2024

The web application for ProGauge MAGLINK LX4 CONSOLE contains an administrative-level user account with a password that cannot be changed.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2024

CVE-2024-42505

Publication date:

25/09/2024

Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba&#39;s Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2024

CVE-2024-42506

Publication date:

25/09/2024

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2024

CVE-2024-42507

Publication date:

25/09/2024

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2024

CVE-2024-42797

Publication date:

25/09/2024

An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Management System v1.0. This vulnerability allows an unauthenticated attacker to delete the valid music playlist entries.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2025

CVE-2024-41725

Publication date:

25/09/2024

ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2024-38324

Publication date:

25/09/2024

IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2024-21545

Publication date:

25/09/2024

Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with &#39;Sys.Audit&#39; or &#39;VM.Monitor&#39; privileges to download arbitrary host files via the API. When handling the result from a request handler before returning it to the user, the handle_api2_request function will check for the ‘download’ or ‘data’->’download’ objects inside the request handler call response object. If present, handle_api2_request will read a local file defined by this object and return it to the user. Two endpoints were identified which can control the object returned by a request handler sufficiently that the ’download’ object is defined and user controlled. This results in arbitrary file read. The privileges of this file read can result in full compromise of the system by various impacts such as disclosing sensitive files allowing for privileged session forgery.

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2024

CVE-2024-39928

Publication date:

25/09/2024

In Apache Linkis

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2025

CVE-2023-5359

Publication date:

25/09/2024

The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions. This would not impact the WordPress users site in any way.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2023-26691

Publication date:

25/09/2024

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

Subscribe to Vulnerabilities