Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-34954

Publication date:

15/05/2024

Code-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2025

CVE-2024-34955

Publication date:

15/05/2024

Code-projects Budget Management 1.0 is vulnerable to SQL Injection via the delete parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

04/04/2025

CVE-2024-25079

Publication date:

15/05/2024

A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2025

CVE-2024-25078

Publication date:

15/05/2024

A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.07, kernel 5.4: IB19130163 in 05.46.07, kernel 5.5: IB19130163 in 05.54.07, and kernel 5.6: IB19130163 in 05.61.07 could lead to escalating privileges in SMM.

Severity CVSS v4.0: Pending analysis

Last modification:

29/07/2025

CVE-2023-6324

Publication date:

15/05/2024

ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2025

CVE-2024-2248

Publication date:

15/05/2024

A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user&#39;s account when clicking on a specially crafted URL sent to the victim’s user email.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2024

CVE-2024-4670

Publication date:

15/05/2024

The All-in-One Video Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.5 via the aiovg_search_form shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2024

CVE-2023-6321

Publication date:

15/05/2024

A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2025

CVE-2023-6322

Publication date:

15/05/2024

A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An attacker can make authenticated requests to trigger this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2025

CVE-2023-6323

Publication date:

15/05/2024

ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server.

Severity CVSS v4.0: Pending analysis

Last modification:

11/02/2025

CVE-2024-4702

Publication date:

15/05/2024

The Mega Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s Button widget in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

03/02/2025

CVE-2024-34100

Publication date:

15/05/2024

Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2024

Subscribe to Vulnerabilities