Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-16638

Publication date:
16/07/2024
An issue was found on the Ruijie EG-2000 series gateway. An attacker can easily dump cleartext stored passwords in /data/config.text with simple XORs. This affects EG-2000SE EG_RGOS 11.1(1)B1.
Severity CVSS v4.0: Pending analysis
Last modification:
18/03/2025

CVE-2019-16639

Publication date:
16/07/2024
An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker (who only has web interface access) to use TELNET commands and/or show admin passwords via the mode_url=exec&command= substring. This affects EG-2000SE EG_RGOS 11.9 B11P1.
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2025

CVE-2019-16640

Publication date:
16/07/2024
An issue was found in upload.php on the Ruijie EG-2000 series gateway. A parameter passed to the class UploadFile is mishandled (%00 and /var/./html are not checked), which can allow an attacker to upload any file to the gateway. This affects EG-2000SE EG_RGOS 11.9 B11P1.
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2025

CVE-2019-16641

Publication date:
16/07/2024
An issue was found on the Ruijie EG-2000 series gateway. There is a buffer overflow in client.so. Consequently, an attacker can use login.php to login to any account, without providing its password. This affects EG-2000SE EG_RGOS 11.1(1)B1.
Severity CVSS v4.0: Pending analysis
Last modification:
09/07/2025

CVE-2024-40322

Publication date:
16/07/2024
An issue was discovered in JFinalCMS v.5.0.0. There is a SQL injection vulnerablity via /admin/div_data/data
Severity CVSS v4.0: Pending analysis
Last modification:
15/08/2024

CVE-2024-22442

Publication date:
16/07/2024
The vulnerability could be remotely exploited to bypass authentication.
Severity CVSS v4.0: Pending analysis
Last modification:
10/10/2024

CVE-2024-33180

Publication date:
16/07/2024
Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/saveParentControlInfo.
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2024

CVE-2024-33182

Publication date:
16/07/2024
Tenda AC18 V15.03.3.10_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/addWifiMacFilter.
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2024

CVE-2024-35338

Publication date:
16/07/2024
Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root.
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2024

CVE-2024-32861

Publication date:
16/07/2024
Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions.
Severity CVSS v4.0: Pending analysis
Last modification:
13/01/2025

CVE-2024-6655

Publication date:
16/07/2024
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.
Severity CVSS v4.0: Pending analysis
Last modification:
14/03/2025

CVE-2022-45449

Publication date:
16/07/2024
Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984.
Severity CVSS v4.0: Pending analysis
Last modification:
07/03/2025