Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-21254

Publication date:

29/01/2021

CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abuse link recognition regular expression, which could cause a significant performance drop resulting in browser tab freeze. It affects all users using CKEditor 5 Markdown plugin at version

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-25646

Publication date:

29/01/2021

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-29557

Publication date:

29/01/2021

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2025

CVE-2021-25138

Publication date:

29/01/2021

The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local buffer overlfow in spx_restservice uploadsshkey function.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2021

CVE-2021-25137

Publication date:

29/01/2021

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2021

CVE-2021-25136

Publication date:

29/01/2021

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2021

CVE-2021-25135

Publication date:

29/01/2021

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2021

CVE-2021-25134

Publication date:

29/01/2021

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2021

CVE-2021-25133

Publication date:

29/01/2021

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2021

CVE-2020-24670

Publication date:

29/01/2021

The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the &#39;type&#39; attribute of &#39;dashboardXml&#39; parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2021

CVE-2020-24669

Publication date:

29/01/2021

The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the &#39;Analysis Report Description&#39; field in &#39;About this Report&#39; section. Remediated in >= 8.3.0.9, >= 9.0.0.1, and >= 9.1.0.0 GA.

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2021

CVE-2020-24666

Publication date:

29/01/2021

The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the &#39;Display Name&#39; parameter. Remediated in >= 9.1.0.1

Severity CVSS v4.0: Pending analysis

Last modification:

04/02/2021

Subscribe to Vulnerabilities