Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-44081

Publication date:

31/10/2022

Lodepng v20220717 was discovered to contain a segmentation fault via the function pngdetail.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2022-43148

Publication date:

31/10/2022

rtf2html v0.2.0 was discovered to contain a heap overflow in the component /rtf2html/./rtf_tools.h.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2022-43152

Publication date:

31/10/2022

tsMuxer v2.6.16 was discovered to contain a heap overflow via the function BitStreamWriter::flushBits() at /tsMuxer/bitStream.h.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2022-39294

Publication date:

31/10/2022

conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request&#39;s length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.to_bytes.html). An attacker could send a malicious request with an abnormally large `Content-Length`, which could lead to a panic if memory allocation failed for that request. In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request"). This crate is part of the implementation of Rust&#39;s [crates.io](https://crates.io/), but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, `conduit-hyper` is not recommended for production use, nor to directly serve the public Internet.

Severity CVSS v4.0: Pending analysis

Last modification:

11/07/2023

CVE-2022-44079

Publication date:

31/10/2022

pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component __sanitizer::StackDepotBase

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2022-43151

Publication date:

31/10/2022

timg v1.4.4 was discovered to contain a memory leak via the function timg::QueryBackgroundColor() at /timg/src/term-query.cc.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2022-2741

Publication date:

31/10/2022

The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The frame must contain the opposite RTR bit as what the filter installed in the vulnerable node contains (if the filter matches RTR frames, the frame must be a data frame or vice versa).

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-40471

Publication date:

31/10/2022

Remote Code Execution in Clinic&#39;s Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2022-3774

Publication date:

31/10/2022

A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.

Severity CVSS v4.0: Pending analysis

Last modification:

01/11/2022

CVE-2022-3408

Publication date:

31/10/2022

The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2022-3374

Publication date:

31/10/2022

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

CVE-2022-3440

Publication date:

31/10/2022

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting

Severity CVSS v4.0: Pending analysis

Last modification:

06/05/2025

Subscribe to Vulnerabilities