Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-5901

Publication date:

07/11/2023

Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.<br /> <br />

Severity CVSS v4.0: Pending analysis

Last modification:

21/01/2024

CVE-2023-5748

Publication date:

07/11/2023

Buffer copy without checking size of input (&#39;Classic Buffer Overflow&#39;) vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local users to conduct denial-of-service attacks via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

CVE-2023-41036

Publication date:

07/11/2023

Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privilege escalation. Distributed objects are a concept introduced by Apple which allow one program to vend an interface to another program. What is not made clear in the documentation is that this service can vend this interface to any other program on the machine. The impact of exploitation is a privilege escalation to root - this is likely to affect anyone who is not careful about the software they download and use MacVim to edit files that would require root privileges. Version 178 contains a fix for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2024

CVE-2023-40453

Publication date:

07/11/2023

Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (via escape sequence injection), or might have a data size that causes a denial of service to a bastion node. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity CVSS v4.0: Pending analysis

Last modification:

09/10/2024

CVE-2023-38509

Publication date:

07/11/2023

XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. This has been patched in XWiki 14.10.9 and XWiki 15.3-rc-1. A workaround is to modify the page `XWiki.LiveTableResultsMacros` following the patch.

Severity CVSS v4.0: Pending analysis

Last modification:

18/03/2024

CVE-2023-2675

Publication date:

07/11/2023

Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223.

Severity CVSS v4.0: Pending analysis

Last modification:

13/11/2023

CVE-2019-25155

Publication date:

07/11/2023

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a &#39;rel="noopener noreferrer"&#39; attribute.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

CVE-2023-36409

Publication date:

07/11/2023

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

12/12/2024

CVE-2023-36769

Publication date:

06/11/2023

Microsoft OneNote Spoofing Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

28/02/2025

CVE-2023-47004

Publication date:

06/11/2023

Buffer Overflow vulnerability in Redis RedisGraph v.2.x through v.2.12.8 and fixed in v.2.12.9 allows an attacker to execute arbitrary code via the code logic after valid authentication.

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2025

CVE-2023-45556

Publication date:

06/11/2023

Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

CVE-2023-5530

Publication date:

06/11/2023

The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2023

Subscribe to Vulnerabilities