Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-11146

Publication date:

17/01/2025

TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.

Severity CVSS v4.0: MEDIUM

Last modification:

24/09/2025

CVE-2024-10799

Publication date:

17/01/2025

The Eventer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.9.7 via the eventer_woo_download_tickets() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Severity CVSS v4.0: Pending analysis

Last modification:

05/06/2025

CVE-2024-13401

Publication date:

17/01/2025

The Payment Button for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s &#39;wp_paypal_checkout&#39; shortcode in all versions up to, and including, 1.2.3.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-13434

Publication date:

17/01/2025

The WP Inventory Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the &#39;message&#39; parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-13398

Publication date:

17/01/2025

The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s &#39;checkout_for_paypal&#39; shortcode in all versions up to, and including, 1.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-51462

Publication date:

17/01/2025

IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data.

Severity CVSS v4.0: Pending analysis

Last modification:

14/08/2025

CVE-2024-52363

Publication date:

17/01/2025

IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2025

CVE-2025-21325

Publication date:

17/01/2025

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Severity CVSS v4.0: Pending analysis

Last modification:

07/02/2025

CVE-2024-34579

Publication date:

17/01/2025

Fuji Electric Alpha5 SMART <br /> <br /> is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2024-57703

Publication date:

16/01/2025

Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability. Affected by this vulnerability is the function setSchedWifi of the file /goform/openSchedWifi. The manipulation of the argument schedEndTime leads to stack-based buffer overflow.

Severity CVSS v4.0: Pending analysis

Last modification:

17/03/2025

CVE-2024-57704

Publication date:

16/01/2025

Severity CVSS v4.0: Pending analysis

Last modification:

17/03/2025

CVE-2025-23198

Publication date:

16/01/2025

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with your specific $DEVICE_ID value):`/device/$DEVICE_ID/edit` -> param: display. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potential unauthorized actions or data exposure. This issue has been addressed in release version 24.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

28/04/2025

Subscribe to Vulnerabilities