Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-36830
Publication date:
30/09/2022
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin
Severity CVSS v4.0: Pending analysis
Last modification:
04/10/2022

CVE-2022-41439
Publication date:
30/09/2022
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2025

CVE-2022-41440
Publication date:
30/09/2022
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2025

CVE-2022-23726
Publication date:
30/09/2022
PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.
Severity CVSS v4.0: Pending analysis
Last modification:
04/10/2022

CVE-2022-41437
Publication date:
30/09/2022
Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2025

CVE-2022-3371
Publication date:
30/09/2022
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.
Severity CVSS v4.0: Pending analysis
Last modification:
04/10/2022

CVE-2022-37461
Publication date:
30/09/2022
Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2025

CVE-2022-2529
Publication date:
30/09/2022
sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.
Severity CVSS v4.0: Pending analysis
Last modification:
04/10/2022

CVE-2022-2922
Publication date:
30/09/2022
Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.
Severity CVSS v4.0: Pending analysis
Last modification:
04/10/2022

CVE-2022-41849
Publication date:
30/09/2022
drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.
Severity CVSS v4.0: Pending analysis
Last modification:
25/03/2024

CVE-2022-41850
Publication date:
30/09/2022
roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.
Severity CVSS v4.0: Pending analysis
Last modification:
25/03/2024

CVE-2022-41848
Publication date:
30/09/2022
drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2025
Subscribe to Vulnerabilities