Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-7396
Publication date:
05/08/2024
Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2.
Severity CVSS v4.0: HIGH
Last modification:
04/11/2025

CVE-2024-7397
Publication date:
05/08/2024
Improper filering of special characters result in a command ('command injection') vulnerability in Korenix JetPort 5601v3.This issue affects JetPort 5601v3: through 1.2.
Severity CVSS v4.0: CRITICAL
Last modification:
04/11/2025

CVE-2024-6865
Publication date:
05/08/2024
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity CVSS v4.0: Pending analysis
Last modification:
05/08/2024

CVE-2024-6472
Publication date:
05/08/2024
Certificate Validation user interface in LibreOffice allows potential vulnerability.<br /> <br /> <br /> <br /> <br /> Signed macros are scripts that have been digitally signed by the <br /> developer using a cryptographic signature. When a document with a signed<br /> macro is opened a warning is displayed by LibreOffice before the macro <br /> is executed.<br /> <br /> Previously if verification failed the user could fail to understand the failure and choose to enable the macros anyway.<br /> <br /> <br /> This issue affects LibreOffice: from 24.2 before 24.2.5.
Severity CVSS v4.0: Pending analysis
Last modification:
10/12/2025

CVE-2024-2937
Publication date:
05/08/2024
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2024

CVE-2024-4607
Publication date:
05/08/2024
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r41p0 through r49p0; Valhall GPU Kernel Driver: from r41p0 through r49p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p0.
Severity CVSS v4.0: Pending analysis
Last modification:
10/09/2024

CVE-2024-40096
Publication date:
05/08/2024
The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log.
Severity CVSS v4.0: Pending analysis
Last modification:
28/10/2024

CVE-2024-36448
Publication date:
05/08/2024
** UNSUPPORTED WHEN ASSIGNED ** Server-Side Request Forgery (SSRF) vulnerability in Apache IoTDB Workbench.<br /> <br /> This issue affects Apache IoTDB Workbench: from 0.13.0.<br /> <br /> As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.<br /> <br /> NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity CVSS v4.0: Pending analysis
Last modification:
13/03/2025

CVE-2024-38856
Publication date:
05/08/2024
Incorrect Authorization vulnerability in Apache OFBiz.<br /> <br /> This issue affects Apache OFBiz: through 18.12.14.<br /> <br /> Users are recommended to upgrade to version 18.12.15, which fixes the issue.<br /> <br /> Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don&amp;#39;t explicitly check user&amp;#39;s permissions because they rely on the configuration of their endpoints).
Severity CVSS v4.0: Pending analysis
Last modification:
23/10/2025

CVE-2024-42447
Publication date:
05/08/2024
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.<br /> <br /> This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.  <br /> <br /> * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)<br /> <br /> * FAB provider 1.2.0 affected all versions of Airflow.<br /> <br /> Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.<br /> <br /> Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.<br /> <br /> Also upgrading Apache Airflow to latest version available is recommended.<br /> <br /> Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images. <br /> <br /> Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.
Severity CVSS v4.0: Pending analysis
Last modification:
19/03/2025

CVE-2024-3636
Publication date:
05/08/2024
The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity CVSS v4.0: Pending analysis
Last modification:
06/06/2025

CVE-2024-5081
Publication date:
05/08/2024
The wp-eMember WordPress plugin before v10.7.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Severity CVSS v4.0: Pending analysis
Last modification:
09/06/2025
Subscribe to Vulnerabilities