Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-45253

Publication date:

14/11/2024

Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;)

Severity CVSS v4.0: Pending analysis

Last modification:

15/11/2024

CVE-2024-38479

Publication date:

14/11/2024

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

03/11/2025

CVE-2024-2550

Publication date:

14/11/2024

A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.

Severity CVSS v4.0: HIGH

Last modification:

24/01/2025

CVE-2024-2551

Publication date:

14/11/2024

A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.

Severity CVSS v4.0: HIGH

Last modification:

24/01/2025

CVE-2024-2552

Publication date:

14/11/2024

A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete files on the firewall.

Severity CVSS v4.0: MEDIUM

Last modification:

24/01/2025

CVE-2024-7787

Publication date:

14/11/2024

Improper Neutralization of Input During Web Page Generation (XSS or &#39;Cross-site Scripting&#39;) vulnerability in ITG Computer Technology vSRM Supplier Relationship Management System allows Reflected XSS, Cross-Site Scripting (XSS).This issue affects vSRM Supplier Relationship Management System: before 28.08.2024.

Severity CVSS v4.0: MEDIUM

Last modification:

15/11/2024

CVE-2024-11206

Publication date:

14/11/2024

Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.

Severity CVSS v4.0: Pending analysis

Last modification:

05/09/2025

CVE-2024-10146

Publication date:

14/11/2024

The Simple File List WordPress plugin before 6.1.13 does not sanitise and escape a generated URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against admins.

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2025

CVE-2024-9186

Publication date:

14/11/2024

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks

Severity CVSS v4.0: Pending analysis

Last modification:

15/05/2025

CVE-2023-34049

Publication date:

14/11/2024

The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.

Severity CVSS v4.0: Pending analysis

Last modification:

15/11/2024

CVE-2024-5082

Publication date:

14/11/2024

A Remote Code Execution vulnerability has been discovered in Sonatype Nexus Repository 2. This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.

Severity CVSS v4.0: HIGH

Last modification:

15/11/2024

CVE-2024-5083

Publication date:

14/11/2024

A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.

Severity CVSS v4.0: MEDIUM

Last modification:

15/11/2024

Subscribe to Vulnerabilities