Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-50489

Publication date:

28/10/2024

Authentication Bypass Using an Alternate Path or Channel vulnerability in Realty Workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through 1.0.45.

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2024

CVE-2024-50492

Publication date:

28/10/2024

Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Scott Paterson ScottCart allows Code Injection.This issue affects ScottCart: from n/a through 1.1.

Severity CVSS v4.0: Pending analysis

Last modification:

31/10/2024

CVE-2024-50408

Publication date:

28/10/2024

Deserialization of Untrusted Data vulnerability in Kiboko Labs Namaste! LMS allows Object Injection.This issue affects Namaste! LMS: from n/a through 2.6.3.

Severity CVSS v4.0: Pending analysis

Last modification:

26/09/2025

CVE-2024-50416

Publication date:

28/10/2024

Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through 1.2.6.

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2024

CVE-2024-50442

Publication date:

28/10/2024

Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons allows XML Injection.This issue affects Royal Elementor Addons: from n/a through 1.3.980.

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2024

CVE-2024-50450

Publication date:

28/10/2024

Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF) allows Code Injection.This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.4.

Severity CVSS v4.0: Pending analysis

Last modification:

29/10/2024

CVE-2024-48074

Publication date:

28/10/2024

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function.

Severity CVSS v4.0: Pending analysis

Last modification:

17/05/2025

CVE-2024-10446

Publication date:

28/10/2024

A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of the file /timetable/admin/admindashboard.php?info=add_course. The manipulation of the argument c leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity CVSS v4.0: MEDIUM

Last modification:

01/11/2024

CVE-2024-38821

Publication date:

28/10/2024

Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring&#39;s static resources support * It must have a non-permitAll authorization rule applied to the static resources support

Severity CVSS v4.0: Pending analysis

Last modification:

24/01/2025

CVE-2024-9162

Publication date:

28/10/2024

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, with Administrator-level access and above, to create an export file with the .php extension on the affected site&#39;s server, adding an arbitrary PHP code to it, which may make remote code execution possible.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2024

CVE-2024-50307

Publication date:

28/10/2024

Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. If a user clicks a specially crafted link in the application, an arbitrary file may be downloaded from an external website and executed. As a result, arbitrary code may be executed on the device that runs Chatwork Desktop Application (Windows).

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2024

CVE-2024-48936

Publication date:

28/10/2024

SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users&#39; jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2025

Subscribe to Vulnerabilities