Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-32461

Publication date:

15/09/2023

Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability, leading to corrupt memory and potentially escalate privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-3378

Publication date:

15/09/2023

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-4673

Publication date:

15/09/2023

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Sanalogy Turasistan allows SQL Injection.This issue affects Turasistan: before 20230911 .

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-4830

Publication date:

15/09/2023

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Tura Signalix allows SQL Injection.This issue affects Signalix: 7T_0228.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-36659

Publication date:

15/09/2023

An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).

Severity CVSS v4.0: Pending analysis

Last modification:

19/09/2023

CVE-2023-36657

Publication date:

15/09/2023

An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.

Severity CVSS v4.0: Pending analysis

Last modification:

19/09/2023

CVE-2023-36658

Publication date:

15/09/2023

An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally.

Severity CVSS v4.0: Pending analysis

Last modification:

03/10/2023

CVE-2023-40983

Publication date:

15/09/2023

A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scripts via injecting a crafted payload into the Find in Results file.

Severity CVSS v4.0: Pending analysis

Last modification:

19/09/2023

CVE-2023-38039

Publication date:

15/09/2023

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

Severity CVSS v4.0: Pending analysis

Last modification:

02/12/2025

CVE-2023-4974

Publication date:

15/09/2023

A vulnerability was found in Academy LMS 6.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument price_min/price_max leads to sql injection. The attack may be launched remotely. VDB-239750 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2024

CVE-2023-40982

Publication date:

15/09/2023

A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cloned module name parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2023

CVE-2023-4963

Publication date:

15/09/2023

The WS Facebook Like Box Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;ws-facebook-likebox&#39; shortcode in versions up to, and including, 5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

Subscribe to Vulnerabilities