Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-26293

Publication date:

11/04/2023

A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation Portal (TIA Portal) V16 (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

13/08/2024

CVE-2023-28828

Publication date:

11/04/2023

A vulnerability has been identified in Polarion ALM (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

09/05/2023

CVE-2023-28489

Publication date:

11/04/2023

A vulnerability has been identified in CP-8031 MASTER MODULE (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2023

CVE-2023-1975

Publication date:

11/04/2023

Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.

Severity CVSS v4.0: Pending analysis

Last modification:

18/04/2023

CVE-2023-29053

Publication date:

11/04/2023

A vulnerability has been identified in JT Open (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2025

CVE-2022-43716

Publication date:

11/04/2023

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

10/09/2024

CVE-2022-43767

Publication date:

11/04/2023

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

10/09/2024

CVE-2022-43768

Publication date:

11/04/2023

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions

Severity CVSS v4.0: Pending analysis

Last modification:

10/09/2024

CVE-2023-1974

Publication date:

11/04/2023

Exposure of Sensitive Information Through Metadata in GitHub repository answerdev/answer prior to 1.0.8.

Severity CVSS v4.0: Pending analysis

Last modification:

18/04/2023

CVE-2023-26593

Publication date:

11/04/2023

CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access the computer where the affected product is installed tampers the password file stored in the computer, the user privilege which CENTUM managed may be escalated. As a result, the control system may be operated with the escalated user privilege. To exploit this vulnerability, the following prerequisites must be met: (1)An attacker has obtained user credentials where the affected product is installed, (2)CENTUM Authentication Mode is used for user authentication when CENTUM VP is used. The affected products and versions are as follows: CENTUM CS 1000, CENTUM CS 3000 (Including CENTUM CS 3000 Entry Class) R2.01.00 to R3.09.50, CENTUM VP (Including CENTUM VP Entry Class) R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, and R6.01.00 and later, B/M9000 CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R7.04.51 and R8.01.01 and later

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2025

CVE-2023-28368

Publication date:

11/04/2023

TP-Link L2 switch T2600G-28SQ firmware versions prior to &#39;T2600G-28SQ(UN)_V1_1.0.6 Build 20230227&#39; uses vulnerable SSH host keys. A fake device may be prepared to spoof the affected device with the vulnerable host key.If the administrator may be tricked to login to the fake device, the credential information for the affected device may be obtained.

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2025

CVE-2023-27389

Publication date:

11/04/2023

Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrative privilege to apply a specially crafted Firmware update file, alter the information, cause a denial-of-service (DoS) condition, and/or execute arbitrary code. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2025

Subscribe to Vulnerabilities