Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-36975

Publication date:

27/01/2026

EPSON Status Monitor 3 version 8.0 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by exploiting the service binary path. Attackers can leverage the unquoted path in &#39;C:\Program Files\Common Files\EPSON\EPW!3SSRP\E_S60RPB.EXE&#39; to inject malicious executables and escalate privileges.

Severity CVSS v4.0: HIGH

Last modification:

27/01/2026

CVE-2020-36976

Publication date:

27/01/2026

Acer Global Registration Service 1.0.0.3 contains an unquoted service path vulnerability in its service configuration that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\Acer\Registration\ to inject malicious executables that would run with elevated LocalSystem privileges during service startup.

Severity CVSS v4.0: HIGH

Last modification:

27/01/2026

CVE-2020-36977

Publication date:

27/01/2026

Wondershare Driver Install Service contains an unquoted service path vulnerability in the ElevationService executable that allows local attackers to potentially inject malicious code. Attackers can exploit the unquoted path to replace the service binary with a malicious executable, enabling privilege escalation to LocalSystem account.

Severity CVSS v4.0: HIGH

Last modification:

27/01/2026

CVE-2020-36978

Publication date:

27/01/2026

Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts through username, name, and firstname parameters to execute code when administrators view customer traffic modules.

Severity CVSS v4.0: MEDIUM

Last modification:

27/01/2026

CVE-2020-36979

Publication date:

27/01/2026

Atheros Coex Service Application 8.0.0.255 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path by placing malicious executables in the service path to gain elevated system privileges during service startup.

Severity CVSS v4.0: HIGH

Last modification:

27/01/2026

CVE-2020-36980

Publication date:

27/01/2026

SAntivirus IC 10.0.21.61 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted executable path to inject malicious files in the service binary path, enabling privilege escalation to system-level permissions.

Severity CVSS v4.0: HIGH

Last modification:

27/01/2026

CVE-2020-36974

Publication date:

27/01/2026

Realtek Andrea RT Filters 1.0.64.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in &#39;C:\Program Files\IDT\WDM\AESTSr64.exe&#39; to inject malicious code that would execute during service startup or system reboot.

Severity CVSS v4.0: HIGH

Last modification:

27/01/2026

CVE-2026-23592

Publication date:

27/01/2026

Insecure file operations in HPE Aruba Networking Fabric Composerâ€™s backup functionality could allow authenticated attackers to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2026

CVE-2026-23593

Publication date:

27/01/2026

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2026

CVE-2026-0919

Publication date:

27/01/2026

The HTTP parser of Tapo C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.

Severity CVSS v4.0: HIGH

Last modification:

27/01/2026

CVE-2026-1315

Publication date:

27/01/2026

By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integrity. An unauthenticated attacker can trigger a persistent denial of service, requiring a manual reboot or application initiated restart to restore normal device operation.

Severity CVSS v4.0: HIGH

Last modification:

27/01/2026

CVE-2026-22260

Publication date:

27/01/2026

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, Suricata can crash with a stack overflow. Version 8.0.3 patches the issue. As a workaround, use default values for `request-body-limit` and `response-body-limit`.

Severity CVSS v4.0: Pending analysis

Last modification:

27/01/2026

Subscribe to Vulnerabilities