Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-11740
Publication date:
19/12/2024
The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Severity CVSS v4.0: Pending analysis
Last modification:
21/03/2025

CVE-2024-11984
Publication date:
19/12/2024
A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.13 allows remote authenticated users to bypass file upload restrictions and perform arbitrary system commands with SYSTEM privilege via a crafted ZIP file.
Severity CVSS v4.0: CRITICAL
Last modification:
20/12/2024

CVE-2024-51532
Publication date:
19/12/2024
Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files.
Severity CVSS v4.0: Pending analysis
Last modification:
29/01/2025

CVE-2023-30443
Publication date:
19/12/2024
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query.
Severity CVSS v4.0: Pending analysis
Last modification:
31/01/2025

CVE-2024-10548
Publication date:
19/12/2024
The WP Project Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.15 via the Project Task List ('/wp-json/pm/v2/projects/1/task-lists') REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the hashed passwords of project owners (e.g. adminstrators).
Severity CVSS v4.0: Pending analysis
Last modification:
05/02/2025

CVE-2024-12121
Publication date:
19/12/2024
The Broken Link Checker | Finder plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.5.0 via the 'moblc_check_link' function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Severity CVSS v4.0: Pending analysis
Last modification:
19/12/2024

CVE-2024-35141
Publication date:
19/12/2024
IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2023-23357
Publication date:
19/12/2024
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to bypass security mechanisms or read application data.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QuLog Center 1.5.0.738 ( 2023/03/06 ) and later<br /> QuLog Center 1.4.1.691 ( 2023/03/01 ) and later<br /> QuLog Center 1.3.1.645 ( 2023/02/22 ) and later
Severity CVSS v4.0: Pending analysis
Last modification:
20/01/2026

CVE-2023-23356
Publication date:
19/12/2024
A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QuFirewall 2.3.3 ( 2023/03/27 ) and later<br /> and later
Severity CVSS v4.0: Pending analysis
Last modification:
24/09/2025

CVE-2022-27600
Publication date:
19/12/2024
An uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to launch a denial-of-service (DoS) attack.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QTS 5.0.1.2277 and later<br /> QTS 4.5.4.2280 build 20230112 and later<br /> QuTS hero h5.0.1.2277 build 20230112 and later<br /> QuTS hero h4.5.4.2374 build 20230417 and later<br /> QuTScloud c5.0.1.2374 and later
Severity CVSS v4.0: Pending analysis
Last modification:
08/12/2025

CVE-2022-27595
Publication date:
19/12/2024
An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have gained user access to execute unauthorized code or commands.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QVPN Windows 2.0.0.1316 and later<br /> QVPN Windows 2.0.0.1310 and later
Severity CVSS v4.0: Pending analysis
Last modification:
08/12/2025

CVE-2023-23354
Publication date:
19/12/2024
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to bypass security mechanisms or read application data.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QuLog Center 1.5.0.738 ( 2023/03/06 ) and later<br /> QuLog Center 1.4.1.691 ( 2023/03/01 ) and later<br /> QuLog Center 1.3.1.645 ( 2023/02/22 ) and later
Severity CVSS v4.0: Pending analysis
Last modification:
20/01/2026
Subscribe to Vulnerabilities