Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-52003

Publication date:

29/11/2024

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: MEDIUM

Last modification:

25/11/2025

CVE-2024-36615

Publication date:

29/11/2024

FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2025

CVE-2024-36616

Publication date:

29/11/2024

An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2025

CVE-2024-36611

Publication date:

29/11/2024

In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. NOTE: the Supplier has concluded that this is a false report.

Severity CVSS v4.0: Pending analysis

Last modification:

03/12/2024

CVE-2024-49360

Publication date:

29/11/2024

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use `explorer.exe` or `cmd.exe` outside any sandbox can read other users&#39; files in `C:\Sandbox\xxx`. By default in Windows 7+, the `C:\Users\UserA` folder is not readable by **UserB**.<br /> All files edited or created during the sandbox processing are affected by the vulnerability. All files in C:\Users are safe. If `UserB` runs a cmd in a sandbox, he will be able to access `C:\Sandox\UserA`. In addition, if **UserB** create a folder `C:\Sandbox\UserA` with malicious ACLs, when **UserA** will user the sandbox, Sandboxie doesn&#39;t reset ACLs ! This issue has not yet been fixed. Users are advised to limit access to their systems using Sandboxie.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2025

CVE-2024-36622

Publication date:

29/11/2024

In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

02/07/2025

CVE-2024-36623

Publication date:

29/11/2024

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

Severity CVSS v4.0: Pending analysis

Last modification:

02/07/2025

CVE-2024-36624

Publication date:

29/11/2024

Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.

Severity CVSS v4.0: Pending analysis

Last modification:

25/11/2025

CVE-2024-36617

Publication date:

29/11/2024

FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2025

CVE-2024-36620

Publication date:

29/11/2024

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

Severity CVSS v4.0: Pending analysis

Last modification:

05/09/2025

CVE-2024-36621

Publication date:

29/11/2024

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

Severity CVSS v4.0: Pending analysis

Last modification:

02/07/2025

CVE-2024-36618

Publication date:

29/11/2024

FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

Subscribe to Vulnerabilities