Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-45806

Publication date:

10/11/2023

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, if a user has been quoted and uses a `|` in their full name, they might be able to trigger a bug that generates a lot of duplicate content in all the posts they&#39;ve been quoted by updating their full name again. Version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches contain a patch for this issue. No known workaround exists, although one can stop the "bleeding" by ensuring users only use alphanumeric characters in their full name field.

Severity CVSS v4.0: Pending analysis

Last modification:

17/11/2023

CVE-2023-45816

Publication date:

10/11/2023

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, there is an edge case where a bookmark reminder is sent and an unread notification is generated, but the underlying bookmarkable (e.g. post, topic, chat message) security has changed, making it so the user can no longer access the underlying resource. As of version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, bookmark reminders are now no longer sent if the user does not have access to the underlying bookmarkable, and also the unread bookmark notifications are always filtered by access. There are no known workarounds.

Severity CVSS v4.0: Pending analysis

Last modification:

16/11/2023

CVE-2023-46130

Publication date:

10/11/2023

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the svgbob or the mermaid theme component are within scope. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable or remove the relevant theme components.

Severity CVSS v4.0: Pending analysis

Last modification:

16/11/2023

CVE-2023-29426

Publication date:

10/11/2023

Cross-Site Request Forgery (CSRF) vulnerability in Robert Schulz (sprd.Net AG) Spreadshop plugin

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2026

CVE-2023-29428

Publication date:

10/11/2023

Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2026

CVE-2023-29440

Publication date:

10/11/2023

Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2026

CVE-2023-30478

Publication date:

10/11/2023

Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2026

CVE-2023-31078

Publication date:

10/11/2023

Cross-Site Request Forgery (CSRF) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2026

CVE-2023-31077

Publication date:

10/11/2023

Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2026

CVE-2023-47164

Publication date:

10/11/2023

Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product.

Severity CVSS v4.0: Pending analysis

Last modification:

16/11/2023

CVE-2023-6073

Publication date:

10/11/2023

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

18/11/2023

CVE-2023-47800

Publication date:

10/11/2023

Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to perform remote code execution, data exfiltration, or other nefarious actions such as tampering with data or destroying/disrupting MSSQL services.

Severity CVSS v4.0: Pending analysis

Last modification:

23/11/2023

Subscribe to Vulnerabilities