Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-31764
Publication date:
06/02/2025
The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apache ShardingSphere ElasticJob-UI version 3.0.1 and prior versions. This vulnerability has been fixed in ElasticJob-UI 3.0.2.<br /> The premise of this attack is that the attacker has obtained the account and password. Otherwise, the attacker cannot perform this attack.
Severity CVSS v4.0: Pending analysis
Last modification:
16/07/2025

CVE-2025-1074
Publication date:
06/02/2025
A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the component URL Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure. They are aware about it and are working on resolving it.
Severity CVSS v4.0: MEDIUM
Last modification:
02/07/2025

CVE-2025-1076
Publication date:
06/02/2025
A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality.
Severity CVSS v4.0: Pending analysis
Last modification:
06/02/2025

CVE-2024-24911
Publication date:
06/02/2025
In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpca process is down, VPN and SIC connectivity issues may occur if the CRL is not present in the Security Gateway&amp;#39;s CRL cache.
Severity CVSS v4.0: Pending analysis
Last modification:
15/10/2025

CVE-2024-57958
Publication date:
06/02/2025
Out-of-bounds array read vulnerability in the FFRT module<br /> Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
Severity CVSS v4.0: Pending analysis
Last modification:
17/03/2025

CVE-2024-57959
Publication date:
06/02/2025
Use-After-Free (UAF) vulnerability in the display module<br /> Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
Severity CVSS v4.0: Pending analysis
Last modification:
17/03/2025

CVE-2024-57960
Publication date:
06/02/2025
Input verification vulnerability in the ExternalStorageProvider module<br /> Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Severity CVSS v4.0: Pending analysis
Last modification:
17/03/2025

CVE-2024-57961
Publication date:
06/02/2025
Out-of-bounds write vulnerability in the emcom module<br /> Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
Severity CVSS v4.0: Pending analysis
Last modification:
17/03/2025

CVE-2024-57962
Publication date:
06/02/2025
Vulnerability of incomplete verification information in the VPN service module<br /> Impact: Successful exploitation of this vulnerability may affect availability.
Severity CVSS v4.0: Pending analysis
Last modification:
17/03/2025

CVE-2024-57954
Publication date:
06/02/2025
Permission verification vulnerability in the media library module<br /> Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Severity CVSS v4.0: Pending analysis
Last modification:
26/09/2025

CVE-2024-57955
Publication date:
06/02/2025
Arbitrary write vulnerability in the Gallery module <br /> Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Severity CVSS v4.0: Pending analysis
Last modification:
26/09/2025

CVE-2024-57956
Publication date:
06/02/2025
Out-of-bounds read vulnerability in the interpreter string module<br /> Impact: Successful exploitation of this vulnerability may affect availability.
Severity CVSS v4.0: Pending analysis
Last modification:
17/03/2025
Subscribe to Vulnerabilities