Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-0753

Publication date:

23/01/2024

In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

07/06/2025

CVE-2024-0748

Publication date:

23/01/2024

A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

11/06/2025

CVE-2024-0746

Publication date:

23/01/2024

A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

20/06/2025

CVE-2024-0750

Publication date:

23/01/2024

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

20/06/2025

CVE-2024-0751

Publication date:

23/01/2024

A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

20/06/2025

CVE-2024-0752

Publication date:

23/01/2024

A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable crash. This vulnerability affects Firefox

Severity CVSS v4.0: Pending analysis

Last modification:

20/06/2025

CVE-2023-44401

Publication date:

23/01/2024

The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number of records per page. Note that this also affects GraphQL queries which have a limit applied, even if the query isn’t paginated per se. This has been fixed in versions 4.3.7 and 5.1.3 by ensuring no new records are pulled in from the database after performing `canView` permission checks for each page of results. This may result in some pages in the query results having less than the maximum number of records per page even when there are more pages of results. This behavior is consistent with how pagination works in other areas of Silverstripe CMS, such as in `GridField`, and is a result of having to perform permission checks in PHP rather than in the database directly. One may disable these permission checks by disabling the `CanViewPermission` plugin.

Severity CVSS v4.0: Pending analysis

Last modification:

30/01/2024

CVE-2023-48714

Publication date:

23/01/2024

Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a `GridField` using the `GridFieldAddExistingAutocompleter` component, the record&#39;s title can be accessed by that user. Versions 4.13.39 and 5.1.11 contain a fix for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

CVE-2023-49783

Publication date:

23/01/2024

Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don&#39;t have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions. The likelihood of a user having create permissions but not having edit or delete permissions is low, but it is possible. Note that this doesn&#39;t affect any `ModelAdmin` which has had the import form disabled via the `showImportForm` public property. Versions 1.13.19 and 2.1.8 contain a patch for the issue. Those who have a custom implementation of `BulkLoader` should update their implementations to respect permissions when the return value of `getCheckPermissions()` is true. Those who use any `BulkLoader` in their own project logic, or maintain a module which uses it, should consider passing `true` to `setCheckPermissions()` if the data is provided by users.

Severity CVSS v4.0: Pending analysis

Last modification:

02/02/2024

CVE-2024-22705

Publication date:

23/01/2024

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2025

CVE-2024-22076

Publication date:

23/01/2024

MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached through the administrative interface.

Severity CVSS v4.0: Pending analysis

Last modification:

16/06/2025