Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-26600
Publication date:
28/03/2022
ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2021-26599
Publication date:
28/03/2022
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2022

CVE-2021-26598
Publication date:
28/03/2022
ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
Severity CVSS v4.0: Pending analysis
Last modification:
04/04/2022

CVE-2022-26255
Publication date:
28/03/2022
Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023

CVE-2022-26258
Publication date:
28/03/2022
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2021-44127
Publication date:
27/03/2022
In DLink DAP-1360 F1 firmware version
Severity CVSS v4.0: Pending analysis
Last modification:
04/04/2022

CVE-2022-26254
Publication date:
27/03/2022
WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names.
Severity CVSS v4.0: Pending analysis
Last modification:
05/04/2022

CVE-2022-26252
Publication date:
27/03/2022
aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH key(id_rsa).
Severity CVSS v4.0: Pending analysis
Last modification:
04/04/2022

CVE-2022-26245
Publication date:
27/03/2022
Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.
Severity CVSS v4.0: Pending analysis
Last modification:
05/04/2022

CVE-2022-1106
Publication date:
27/03/2022
use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
Severity CVSS v4.0: Pending analysis
Last modification:
31/03/2022

CVE-2022-27948
Publication date:
27/03/2022
Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. NOTE: the vendor's perspective is that the behavior is as intended
Severity CVSS v4.0: Pending analysis
Last modification:
03/08/2024

CVE-2022-26205
Publication date:
27/03/2022
Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. This vulnerability allows attackers to execute arbitrary code via injection of a crafted payload.
Severity CVSS v4.0: Pending analysis
Last modification:
08/08/2023
Subscribe to Vulnerabilities