Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-9401

Publication date:

01/10/2024

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-47604

Publication date:

01/10/2024

NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element attributes, which allows an attacker to execute arbitrary HTML or Javascript code in a victim&#39;s browser.

Severity CVSS v4.0: Pending analysis

Last modification:

13/11/2024

CVE-2024-9391

Publication date:

01/10/2024

A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible.<br /> *This bug only affects Firefox Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2025

CVE-2024-9395

Publication date:

01/10/2024

A specially crafted filename containing a large number of spaces could obscure the file&#39;s extension when displayed in the download dialog.<br /> *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2025

CVE-2024-9396

Publication date:

01/10/2024

It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2025

CVE-2024-9397

Publication date:

01/10/2024

A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2024-9398

Publication date:

01/10/2024

By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2025

CVE-2024-9399

Publication date:

01/10/2024

A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

14/03/2025

CVE-2024-9392

Publication date:

01/10/2024

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-9393

Publication date:

01/10/2024

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-9394

Publication date:

01/10/2024

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-25659

Publication date:

01/10/2024

In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux servers allows remote attacker to access files and directories outside the SFTP user home directory.

Severity CVSS v4.0: Pending analysis

Last modification:

03/07/2025

Subscribe to Vulnerabilities