Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-6203

Publication date:

18/12/2023

The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

CVE-2023-6222

Publication date:

18/12/2023

IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2023-6272

Publication date:

18/12/2023

The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force all possibilities, which shouldn&#39;t be too long, as the 2FA codes are 6 digits.

Severity CVSS v4.0: Pending analysis

Last modification:

22/12/2023

CVE-2023-5005

Publication date:

18/12/2023

The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2025

CVE-2023-6289

Publication date:

18/12/2023

The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin&#39;s settings, which may include sensitive information such as Cloudflare API tokens.

Severity CVSS v4.0: Pending analysis

Last modification:

07/05/2025

CVE-2023-4724

Publication date:

18/12/2023

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server

Severity CVSS v4.0: Pending analysis

Last modification:

20/05/2025

CVE-2023-51384

Publication date:

18/12/2023

In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2024

CVE-2023-51385

Publication date:

18/12/2023

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

Severity CVSS v4.0: Pending analysis

Last modification:

13/03/2024

CVE-2023-6691

Publication date:

18/12/2023

Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gain root privileges.

Severity CVSS v4.0: Pending analysis

Last modification:

28/12/2023

CVE-2023-6920

Publication date:

18/12/2023

Rejected reason: This flaw was found to be a duplicate of CVE-2023-6927. Please see https://access.redhat.com/security/cve/CVE-2023-6927 for information about affected products and security errata.

Severity CVSS v4.0: Pending analysis

Last modification:

18/12/2023

CVE-2023-48762

Publication date:

18/12/2023

Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2023

CVE-2023-48766

Publication date:

18/12/2023

Cross-Site Request Forgery (CSRF) vulnerability in SVGator SVGator – Add Animated SVG Easily.This issue affects SVGator – Add Animated SVG Easily: from n/a through 1.2.4.

Severity CVSS v4.0: Pending analysis

Last modification:

20/12/2023

Subscribe to Vulnerabilities