Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-4445

Publication date:

02/09/2020

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 181122.

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2020

CVE-2020-4522

Publication date:

02/09/2020

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2020

CVE-2020-4546

Publication date:

02/09/2020

Severity CVSS v4.0: Pending analysis

Last modification:

08/09/2020

CVE-2020-4693

Publication date:

02/09/2020

IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to execute arbitrary code on the system, caused by improper validation of data prior to export. IBM X-Force ID: 186782.

Severity CVSS v4.0: Pending analysis

Last modification:

10/09/2020

CVE-2020-15094

Publication date:

02/09/2020

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2020-15167

Publication date:

02/09/2020

In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2026

CVE-2020-24030

Publication date:

02/09/2020

ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOTE: as of 2025-10-14, the Supplier&#39;s perspective is that this is "not exploitable in the current implementation. Tokens are properly expired, invalidated, and bound to session context. Attempts to alter the token payload to extend its validity do not affect server-side validation."

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2025

CVE-2020-24029

Publication date:

02/09/2020

Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier&#39;s perspective is that this is "corrected in all maintained versions. Password reset requests are validated against registered user emails and require a valid, short-lived token."

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2025

CVE-2020-24553

Publication date:

02/09/2020

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-24654

Publication date:

02/09/2020

In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user&#39;s home directory.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2020-24028

Publication date:

02/09/2020

ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. NOTE: as of 2025-10-14, the Supplier&#39;s perspective is that this "does not allow administrative privilege gain. Authorization is enforced server-side, restricting actions to the user’s own permission scope."

Severity CVSS v4.0: Pending analysis

Last modification:

14/10/2025

CVE-2020-25025

Publication date:

02/09/2020

The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2021

Subscribe to Vulnerabilities