Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-49964

Publication date:

11/12/2023

An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.

Severity CVSS v4.0: Pending analysis

Last modification:

14/12/2023

CVE-2023-49355

Publication date:

11/12/2023

decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input. NOTE: this is not the same as CVE-2023-50246. The CVE-2023-50246 71c2ab5 reference mentions -10E-1000010001, which is not in normalized scientific notation.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2023-5500

Publication date:

11/12/2023

This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code (&#39;Code Injection&#39;) to gain full control of the affected device.

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2023-48417

Publication date:

11/12/2023

Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application

Severity CVSS v4.0: Pending analysis

Last modification:

13/12/2023

CVE-2023-48425

Publication date:

11/12/2023

U-Boot vulnerability resulting in persistent Code Execution

Severity CVSS v4.0: Pending analysis

Last modification:

27/05/2025

CVE-2023-6181

Publication date:

11/12/2023

An oversight in BCB handling of reboot reason that allows for persistent code execution

Severity CVSS v4.0: Pending analysis

Last modification:

13/12/2023

CVE-2023-48424

Publication date:

11/12/2023

U-Boot shell vulnerability resulting in Privilege escalation in a production device

Severity CVSS v4.0: Pending analysis

Last modification:

25/02/2026

CVE-2023-50465

Publication date:

11/12/2023

A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated user.

Severity CVSS v4.0: Pending analysis

Last modification:

13/12/2023

CVE-2023-6659

Publication date:

11/12/2023

A vulnerability, which was classified as critical, has been found in Campcodes Web-Based Student Clearance System 1.0. This issue affects some unknown processing of the file /libsystem/login.php. The manipulation of the argument student leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247367.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2025

CVE-2023-50463

Publication date:

10/12/2023

The caddy-geo-ip (aka GeoIP) middleware through 0.6.0 for Caddy 2, when trust_header X-Forwarded-For is used, allows attackers to spoof their source IP address via an X-Forwarded-For header, which may bypass a protection mechanism (trusted_proxy directive in reverse_proxy or IP address range restrictions).

Severity CVSS v4.0: Pending analysis

Last modification:

21/11/2024

CVE-2023-6658

Publication date:

10/12/2023

A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file ajax-api.php?action=save_attendance. The manipulation of the argument class_id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-247366 is the identifier assigned to this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2024

CVE-2023-6656

Publication date:

10/12/2023

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. It has been rated as critical. Affected by this issue is some unknown functionality of the file DFLIMG/DFLJPG.py. The manipulation leads to deserialization. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of this vulnerability is VDB-247364. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity CVSS v4.0: Pending analysis

Last modification:

02/08/2024

Subscribe to Vulnerabilities