Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-35161

Publication date:

21/06/2024

Rejected reason: CVE ID was once reserved, but never used.

Severity CVSS v4.0: Pending analysis

Last modification:

21/06/2024

CVE-2020-35162

Publication date:

21/06/2024

Rejected reason: CVE ID was once reserved, but never used.

Severity CVSS v4.0: Pending analysis

Last modification:

21/06/2024

CVE-2024-35246

Publication date:

20/06/2024

An attacker may be able to cause a denial-of-service condition by sending many packets repeatedly.

Severity CVSS v4.0: HIGH

Last modification:

30/07/2025

CVE-2024-37899

Publication date:

20/06/2024

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user&#39;s profile is executed with the admin&#39;s rights. This allows a user to place malicious code in the user profile before getting an admin to disable the user account. To reproduce, as a user without script nor programming rights, edit the about section of your user profile and add `{{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}}`. As an admin, go to the user profile and click the "Disable this account" button. Then, reload the page. If the logs show `attacker - Hello from Groovy!` then the instance is vulnerable. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. ### Workarounds We&#39;re not aware of any workaround except upgrading. ### References * https://jira.xwiki.org/browse/XWIKI-21611 * https://github.com/xwiki/xwiki-platform/commit/f89c8f47fad6e5cc7e68c69a7e0acde07f5eed5a

Severity CVSS v4.0: Pending analysis

Last modification:

05/02/2025

CVE-2024-38359

Publication date:

20/06/2024

The Lightning Network Daemon (lnd) - is a complete implementation of a Lightning Network node. A parsing vulnerability in lnd&#39;s onion processing logic and lead to a DoS vector due to excessive memory allocation. The issue was patched in lnd v0.17.0. Users should update to a version > v0.17.0 to be protected. Users unable to upgrade may set the `--rejecthtlc` CLI flag and also disable forwarding on channels via the `UpdateChanPolicyCommand`, or disable listening on a public network interface via the `--nolisten` flag as a mitigation.

Severity CVSS v4.0: Pending analysis

Last modification:

21/06/2024

CVE-2024-38361

Publication date:

20/06/2024

Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

02/09/2025

CVE-2024-32943

Publication date:

20/06/2024

An attacker may be able to cause a denial-of-service condition by sending many SSH packets repeatedly.

Severity CVSS v4.0: HIGH

Last modification:

30/07/2025

CVE-2024-5746

Publication date:

20/06/2024

A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator role to gain arbitrary code execution capability on the GitHub Enterprise Server instance. Exploitation required authenticated access to GitHub Enterprise Server as a user with the Site Administrator role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13 and was fixed in versions 3.12.5, 3.11.11, 3.10.13, and 3.9.16. This vulnerability was reported via the GitHub Bug Bounty program.

Severity CVSS v4.0: Pending analysis

Last modification:

27/08/2025

CVE-2024-37183

Publication date:

20/06/2024

Plain text credentials and session ID can be captured with a network sniffer.

Severity CVSS v4.0: MEDIUM

Last modification:

30/07/2025

CVE-2024-29390

Publication date:

20/06/2024

Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the &#39;add-expense.php&#39; page. An attacker can exploit the &#39;item&#39; parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done by injecting specially crafted SQL queries that make the database perform time-consuming operations, thereby confirming the presence of the SQL injection vulnerability based on the delay in the server&#39;s response.

Severity CVSS v4.0: Pending analysis

Last modification:

20/06/2025

CVE-2024-30848

Publication date:

20/06/2024

Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script or HTML via the version parameter.

Severity CVSS v4.0: Pending analysis

Last modification:

01/08/2024

CVE-2024-31586

Publication date:

20/06/2024

A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerability allows a remote attacker to execute arbitrary code via the Borrower Name, Department, and Remarks parameters.

Severity CVSS v4.0: Pending analysis

Last modification:

11/04/2025

Subscribe to Vulnerabilities