Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-22533

Publication date:

02/02/2024

Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

06/06/2025

CVE-2024-22319

Publication date:

02/02/2024

IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 279145.

Severity CVSS v4.0: Pending analysis

Last modification:

21/03/2024

CVE-2024-22320

Publication date:

02/02/2024

IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.

Severity CVSS v4.0: Pending analysis

Last modification:

21/03/2024

CVE-2023-46159

Publication date:

02/02/2024

IBM Storage Ceph 5.3z1, 5.3z5, and 6.1z1 could allow an authenticated user on the network to cause a denial of service from RGW. IBM X-Force ID: 268906.

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2024

CVE-2024-23746

Publication date:

02/02/2024

Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents).

Severity CVSS v4.0: Pending analysis

Last modification:

04/06/2025

CVE-2024-22899

Publication date:

02/02/2024

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2024-22900

Publication date:

02/02/2024

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2024-22901

Publication date:

02/02/2024

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2024-22902

Publication date:

02/02/2024

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2024-22903

Publication date:

02/02/2024

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2023-50935

Publication date:

02/02/2024

IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to application functionality and/or resources. IBM X-Force ID: 275115.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

CVE-2023-50938

Publication date:

02/02/2024

IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim&#39;s click actions and possibly launch further attacks against the victim. IBM X-Force ID: 275128.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

Subscribe to Vulnerabilities