Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-16015

Publication date:

17/07/2026

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create_task of the file executor_manager/app/api/v1/tasks.py of the component executor_manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.5.7 is able to resolve this issue. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. It is recommended to upgrade the affected component.

Severity CVSS v4.0: LOW

Last modification:

17/07/2026

CVE-2026-16072

Publication date:

17/07/2026

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. By using this link, the administrator can create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account. This allows an administrator to bypass security boundaries and add unauthorized members to an organization.

Severity CVSS v4.0: Pending analysis

Last modification:

21/07/2026

CVE-2025-60357

Publication date:

17/07/2026

AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-23578

Publication date:

17/07/2026

HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5 cross-origin resource sharing (CORS) policy for this request that allows access from any domain (*-Wildcard).

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-42214

Publication date:

17/07/2026

HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the Web server which allows an attacker to narrow and intensify their efforts.

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-23569

Publication date:

17/07/2026

HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-23570

Publication date:

17/07/2026

HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his malicious site. The attacker can then launch a Clickjacking attack, which may lead to Phishing, Cross-Site Request Forgery, sensitive information leakage and more.

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-23571

Publication date:

17/07/2026

HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be cached. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-23572

Publication date:

17/07/2026

HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-23573

Publication date:

17/07/2026

HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or 1.2 implementations . It also affects previous versions such as SSL3.0 and TLS1.0. This can also be considered a type of man-in-the-middle attack.

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-23574

Publication date:

17/07/2026

HCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use brute-force techniques to either guess or confirm valid users in the system. Use renumeration is when a malicious actor can use brute-force techniques to either guess or confirm valid users in a system

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

CVE-2024-23575

Publication date:

17/07/2026

HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An attacker may use the contents of error messages to help launch another ,more focused attack.

Severity CVSS v4.0: Pending analysis

Last modification:

17/07/2026

Subscribe to Vulnerabilities