Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-30333

Publication date:

09/05/2022

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2022-23066

Publication date:

09/05/2022

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.

Severity CVSS v4.0: Pending analysis

Last modification:

10/02/2023

CVE-2022-28463

Publication date:

08/05/2022

ImageMagick 7.1.0-27 is vulnerable to Buffer Overflow.

Severity CVSS v4.0: Pending analysis

Last modification:

25/06/2025

CVE-2022-28470

Publication date:

08/05/2022

marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2022

CVE-2022-1620

Publication date:

08/05/2022

NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2022-1619

Publication date:

08/05/2022

Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2018-25033

Publication date:

08/05/2022

ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.

Severity CVSS v4.0: Pending analysis

Last modification:

06/10/2022

CVE-2022-1616

Publication date:

07/05/2022

Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2022-30334

Publication date:

07/05/2022

Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers. NOTE: although this was fixed by Brave, the Brave documentation still advises "Note that Private Windows with Tor Connectivity in Brave are just regular private windows that use Tor as a proxy. Brave does NOT implement most of the privacy protections from Tor Browser."

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2022-29180

Publication date:

07/05/2022

A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delete anything on the server. This has been patched and is available in release [v0.12.1](https://github.com/charmbracelet/charm/releases/tag/v0.12.1). We recommend that all users running self-hosted `charm` instances update immediately. This vulnerability was found in-house and we haven&#39;t been notified of any potential exploiters. ### Additional notes * Encrypted user data uploaded to the Charm server is safe as Charm servers cannot decrypt user data. This includes filenames, paths, and all key-value data. * Users running the official Charm [Docker images](https://github.com/charmbracelet/charm/blob/main/docker.md) are at minimal risk because the exploit is limited to the containerized filesystem.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2022

CVE-2022-30330

Publication date:

07/05/2022

In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security restrictions on firmware operations. Using these flaws, malicious firmware code can elevate privileges, permanently make the device inoperable or overwrite the trusted bootloader code to compromise the hardware wallet across reboots or storage wipes.

Severity CVSS v4.0: Pending analysis

Last modification:

08/08/2023

CVE-2021-23592

Publication date:

06/05/2022

The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2022

Subscribe to Vulnerabilities