Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-25091

Publication date:
01/03/2024
Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feature) and RevoWorks Browser prior to 2.2.95 (when using 'VirusChecker' or 'ThreatChecker' feature). If data containing malware is saved in a specific file format (eml, dmg, vhd, iso, msi), malware may be taken outside the sandboxed environment.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2024-25554

Publication date:
01/03/2024
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity CVSS v4.0: Pending analysis
Last modification:
01/03/2024

CVE-2024-27949

Publication date:
01/03/2024
Server-Side Request Forgery (SSRF) vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
01/04/2026

CVE-2024-27950

Publication date:
01/03/2024
Missing Authorization vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through
Severity CVSS v4.0: Pending analysis
Last modification:
01/04/2026

CVE-2023-52555

Publication date:
01/03/2024
In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.
Severity CVSS v4.0: Pending analysis
Last modification:
13/05/2025

CVE-2024-25552

Publication date:
01/03/2024
A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product.
Severity CVSS v4.0: Pending analysis
Last modification:
04/03/2025

CVE-2024-25553

Publication date:
01/03/2024
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity CVSS v4.0: Pending analysis
Last modification:
01/03/2024

CVE-2024-1859

Publication date:
01/03/2024
The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization of untrusted input to the awl_slider_responsive_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Severity CVSS v4.0: Pending analysis
Last modification:
08/04/2026

CVE-2024-22891

Publication date:
01/03/2024
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.
Severity CVSS v4.0: Pending analysis
Last modification:
13/05/2025

CVE-2024-25293

Publication date:
01/03/2024
mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.
Severity CVSS v4.0: Pending analysis
Last modification:
13/05/2025

CVE-2024-25386

Publication date:
01/03/2024
Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the format_logfile.pl file.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2023-38366

Publication date:
01/03/2024
IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 261115.
Severity CVSS v4.0: Pending analysis
Last modification:
23/04/2025