Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-21881

Publication date:

12/08/2024

Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2024-22114

Publication date:

12/08/2024

User with no permission to any of the Hosts can access and view host count & other statistics through System Information Widget in Global View Dashboard.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-22116

Publication date:

12/08/2024

An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-21876

Publication date:

12/08/2024

Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability via a URL parameter in Enphase IQ Gateway (formerly known as Envoy) allows an unautheticated attacker to access or create arbitratry files.This issue affects Envoy: from 4.x to 8.x and

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2024

CVE-2024-21877

Publication date:

12/08/2024

Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) vulnerability through a url parameter in Enphase IQ Gateway (formerly known as Envoy) allows File Manipulation. The endpoint requires authentication.This issue affects Envoy: from 4.x to 8.0 and

Severity CVSS v4.0: Pending analysis

Last modification:

23/08/2024

CVE-2023-50810

Publication date:

12/08/2024

In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware that allow persistent arbitrary code execution with Linux kernel privileges. A failure to correctly handle the return value of the setenv command can be used to override the kernel command-line parameters and ultimately bypass the Secure Boot implementation. This affects PLAY5 gen 2, PLAYBASE, PLAY:1, One, One SL, and Amp.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-0113

Publication date:

12/08/2024

NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A successful exploit of this vulnerability might lead to escalation of privileges and information disclosure.

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2024

CVE-2024-0115

Publication date:

12/08/2024

NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled resource consumption issue by a long running CV-CUDA Python process. A successful exploit of this vulnerability may lead to denial of service and data loss.

Severity CVSS v4.0: Pending analysis

Last modification:

26/12/2024

CVE-2023-50809

Publication date:

12/08/2024

In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an information element during negotiation of a WPA2 four-way handshake. This lack of validation leads to a stack buffer overflow. This can result in remote code execution within the kernel. This affects Amp, Arc, Arc SL, Beam, Beam Gen 2, Beam SL, and Five.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2023-31315

Publication date:

12/08/2024

Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2023-38018

Publication date:

12/08/2024

IBM Aspera Shares 1.10.0 PL2 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 260574.

Severity CVSS v4.0: Pending analysis

Last modification:

29/08/2024