Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-23660
Publication date:
08/02/2024
The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 2023. An attacker can systematically generate mnemonics for each timestamp within an applicable timeframe, and link them to specific wallet addresses in order to steal funds from those wallets.
Severity CVSS v4.0: Pending analysis
Last modification:
15/05/2025

CVE-2024-24115
Publication date:
08/02/2024
A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
Severity CVSS v4.0: Pending analysis
Last modification:
23/01/2026

CVE-2024-22795
Publication date:
08/02/2024
Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status component.
Severity CVSS v4.0: Pending analysis
Last modification:
05/06/2025

CVE-2024-23764
Publication date:
08/02/2024
Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, WithSecure Email and Server Security 15 and later, and WithSecure Elements Endpoint Protection 17 and later.
Severity CVSS v4.0: Pending analysis
Last modification:
15/05/2025

CVE-2024-24215
Publication date:
08/02/2024
An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information via a crafted POST request.
Severity CVSS v4.0: Pending analysis
Last modification:
20/06/2025

CVE-2023-50061
Publication date:
08/02/2024
PrestaShop Op'art Easy Redirect >= 1.3.8 and
Severity CVSS v4.0: Pending analysis
Last modification:
22/08/2024

CVE-2024-24213
Publication date:
08/02/2024
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically, /pg_meta/default/query is for SQL queries that are entered in an intended UI by an authorized user. Nothing is injected.
Severity CVSS v4.0: Pending analysis
Last modification:
21/08/2024

CVE-2024-24321
Publication date:
08/02/2024
An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.
Severity CVSS v4.0: Pending analysis
Last modification:
20/06/2025

CVE-2024-25190
Publication date:
08/02/2024
l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Severity CVSS v4.0: Pending analysis
Last modification:
19/08/2024

CVE-2024-25191
Publication date:
08/02/2024
php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Severity CVSS v4.0: Pending analysis
Last modification:
12/06/2025

CVE-2023-42282
Publication date:
08/02/2024
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Severity CVSS v4.0: Pending analysis
Last modification:
15/05/2025

CVE-2024-25189
Publication date:
08/02/2024
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.
Severity CVSS v4.0: Pending analysis
Last modification:
18/11/2025
Subscribe to Vulnerabilities