Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-1046
Publication date:
17/08/2020
A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system.<br /> To exploit the vulnerability, an attacker would need to be able to upload a specially crafted file to a web application.<br /> The security update addresses the vulnerability by correcting how .NET Framework processes input.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1182
Publication date:
17/08/2020
A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server.<br /> An authenticated attacker with privileges to import and export data could exploit this vulnerability by sending a specially crafted file to a vulnerable Dynamics server.<br /> The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11 handles user input.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1337
Publication date:
17/08/2020
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.<br /> To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application.<br /> The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1339
Publication date:
17/08/2020
A remote code execution vulnerability exists when Windows Media Audio Codec improperly handles objects. An attacker who successfully exploited the vulnerability could take control of an affected system.<br /> There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit a malicious webpage.<br /> The security update addresses the vulnerability by correcting how Windows Media Audio Codec handles objects.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1377
Publication date:
17/08/2020
An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system.<br /> A locally authenticated attacker could exploit this vulnerability by running a specially crafted application.<br /> The security update addresses the vulnerability by helping to ensure that the Windows Kernel API properly handles objects in memory.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1378
Publication date:
17/08/2020
An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory. An attacker who successfully exploited the vulnerability could gain elevated privileges on a targeted system.<br /> A locally authenticated attacker could exploit this vulnerability by running a specially crafted application.<br /> The security update addresses the vulnerability by helping to ensure that the Windows Kernel API properly handles objects in memory.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1379
Publication date:
17/08/2020
A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights.<br /> There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit a malicious webpage.<br /> The security update addresses the vulnerability by correcting how Windows Media Foundation handles objects in memory.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1383
Publication date:
17/08/2020
An information disclosure vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system<br /> To exploit this vulnerability, an attacker would need to run a specially crafted application against an RPC server which has Routing and Remote Access enabled. Routing and Remote Access is a non-default configuration; systems without it enabled are not vulnerable.<br /> The security update addresses the vulnerability by correcting how the Routing and Remote Access service handles requests.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1417
Publication date:
17/08/2020
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.<br /> To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application to take control of an affected system.<br /> The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1455
Publication date:
17/08/2020
A denial of service vulnerability exists when Microsoft SQL Server Management Studio (SSMS) improperly handles files. An attacker could exploit the vulnerability to trigger a denial of service.<br /> To exploit the vulnerability, an attacker would first require execution on the victim system.<br /> The security update addresses the vulnerability by ensuring Microsoft SQL Server Management Studio properly handles files.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1459
Publication date:
17/08/2020
An information disclosure vulnerability exists on ARM implementations that use speculative execution in control flow via a side-channel analysis, aka &amp;quot;straight-line speculation.&amp;quot;<br /> To exploit this vulnerability, an attacker with local privileges would need to run a specially crafted application.<br /> The security update addresses the vulnerability by bypassing the speculative execution.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2020-1466
Publication date:
17/08/2020
A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system using RDP and sends specially crafted requests. An attacker who successfully exploited this vulnerability could cause the RD Gateway service on the target system to stop responding.<br /> To exploit this vulnerability, an attacker would need to run a specially crafted application against a server which provides RD Gateway services.<br /> The update addresses the vulnerability by correcting how RD Gateway handles connection requests.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026
Subscribe to Vulnerabilities