Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-26520

Publication date:

26/07/2024

An issue in Hangzhou Xiongwei Technology Development Co., Ltd. Restaurant Digital Comprehensive Management platform v1 allows an attacker to bypass authentication and perform arbitrary password resets.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2024

CVE-2024-27357

Publication date:

26/07/2024

An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and WithSecure MDR through 23.x for macOS. Local Privilege Escalation can occur during installations or updates by admins.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2024

CVE-2024-27358

Publication date:

26/07/2024

An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. Local users can block an admin from completing an installation, aka a Denial-of-Service (DoS).

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2024

CVE-2023-50700

Publication date:

26/07/2024

Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be called by unprivileged users via the D-Bus method.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2024

CVE-2024-41356

Publication date:

26/07/2024

phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2024-41357

Publication date:

26/07/2024

phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2024-41807

Publication date:

26/07/2024

Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2023-4759. Reason: This record is a reservation duplicate of CVE-2023-4759. Notes: All CVE users should reference CVE-2023-4759 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.

Severity CVSS v4.0: Pending analysis

Last modification:

26/07/2024

CVE-2024-7050

Publication date:

26/07/2024

Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular scenarios.This issue affects OpenText Directory Services: 24.2.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2024

CVE-2024-41355

Publication date:

26/07/2024

phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2026

CVE-2024-41670

Publication date:

26/07/2024

In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer can confirm an order even if payment is finally declined by PayPal. A logical weakness during the capture of a payment in case of disabled webhooks can be exploited to create an accepted order. This could allow a threat actor to confirm an order with a fraudulent payment support. Versions 6.4.2 and 3.18.1 contain a patch for the issue. Additionally, users enable webhooks and check they are callable.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2024

CVE-2024-41805

Publication date:

26/07/2024

Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected cross-site scripting enables execution of malicious JavaScript in the context of a user’s browser if that user clicks on a malicious link, allowing phishing attacks that could lead to credential theft. Tracks version 2.7.1 is patched. No known complete workarounds are available.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2024

CVE-2024-6922

Publication date:

26/07/2024

Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthenticated access to the Automation 360 Control Room HTTPS service (port 443) or HTTP service (port 80) can trigger arbitrary web requests from the server.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2024

Subscribe to Vulnerabilities