Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-4017

Publication date:
01/12/2021
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2021

CVE-2021-4015

Publication date:
01/12/2021
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2021

CVE-2021-3994

Publication date:
01/12/2021
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2021

CVE-2021-3993

Publication date:
01/12/2021
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2021

CVE-2021-3992

Publication date:
01/12/2021
kimai2 is vulnerable to Improper Access Control
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2022

CVE-2021-3984

Publication date:
01/12/2021
vim is vulnerable to Heap-based Buffer Overflow
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-3990

Publication date:
01/12/2021
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2021

CVE-2021-3989

Publication date:
01/12/2021
showdoc is vulnerable to URL Redirection to Untrusted Site
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2021

CVE-2021-3985

Publication date:
01/12/2021
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2021

CVE-2021-4018

Publication date:
01/12/2021
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity CVSS v4.0: Pending analysis
Last modification:
02/12/2021

CVE-2021-4019

Publication date:
01/12/2021
vim is vulnerable to Heap-based Buffer Overflow
Severity CVSS v4.0: Pending analysis
Last modification:
29/05/2026

CVE-2021-34599

Publication date:
01/12/2021
Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.
Severity CVSS v4.0: Pending analysis
Last modification:
28/07/2022