Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-31469
Publication date:
14/05/2024
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2024-31470
Publication date:
14/05/2024
There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2024-31471
Publication date:
14/05/2024
There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2024-31467
Publication date:
14/05/2024
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2024-31468
Publication date:
14/05/2024
There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2024-35175
Publication date:
14/05/2024
sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.
Severity CVSS v4.0: Pending analysis
Last modification:
15/05/2024

CVE-2024-31466
Publication date:
14/05/2024
There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system.
Severity CVSS v4.0: Pending analysis
Last modification:
24/06/2025

CVE-2023-33327
Publication date:
14/05/2024
Improper Privilege Management vulnerability in Teplitsa of social technologies Leyka allows Privilege Escalation.This issue affects Leyka: from n/a through 3.30.2.
Severity CVSS v4.0: Pending analysis
Last modification:
17/05/2024

CVE-2024-4561
Publication date:
14/05/2024
<br /> In WhatsUp Gold versions released before 2023.1.2 , <br /> <br /> a blind SSRF vulnerability exists in Whatsup Gold&amp;#39;s FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
09/12/2024

CVE-2024-4562
Publication date:
14/05/2024
<br /> In WhatsUp Gold versions released before 2023.1.2 , <br /> <br /> an SSRF vulnerability exists in Whatsup Gold&amp;#39;s <br /> <br /> Issue exists in the HTTP Monitoring functionality.  <br /> <br /> Due to the lack of proper authorization, any authenticated user can access the HTTP monitoring functionality, what leads to the Server Side Request Forgery.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
09/12/2024

CVE-2024-31556
Publication date:
14/05/2024
An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function.
Severity CVSS v4.0: Pending analysis
Last modification:
03/07/2024

CVE-2024-3044
Publication date:
14/05/2024
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2025
Subscribe to Vulnerabilities