Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-23472

Publication date:

11/12/2024

IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.

Severity CVSS v4.0: Pending analysis

Last modification:

11/03/2025

CVE-2024-12325

Publication date:

11/12/2024

The Waymark plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-11840

Publication date:

11/12/2024

The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-12294

Publication date:

11/12/2024

The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the &#39;get_legacy_cookies&#39; function. This makes it possible for unauthenticated attackers to extract sensitive data including titles and permalinks of private, password-protected, pending, and draft posts.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-11008

Publication date:

11/12/2024

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-12363

Publication date:

11/12/2024

Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a local authenticated user to delete arbitrary files. TeamViewer Patch & Asset Management is part of TeamViewer Remote Management.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-54269

Publication date:

11/12/2024

Missing Authorization vulnerability in Ninja Team Notibar notibar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notibar: from n/a through

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2026

CVE-2024-11401

Publication date:

11/12/2024

Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby, due to a lack of authorization checks, an attacker can successfully update the password policy in the platform settings as a standard user by crafting an API (the functionality was not possible through the platform&#39;s User Interface). This vulnerability has been fixed as of November 13th 2024.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2024-11737

Publication date:

11/12/2024

CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of<br /> confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.

Severity CVSS v4.0: CRITICAL

Last modification:

15/04/2026

CVE-2024-12283

Publication date:

11/12/2024

The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

26/11/2025

CVE-2024-10511

Publication date:

11/12/2024

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface<br /> when someone on the local network repeatedly requests the /accessdenied URL.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2024-12004

Publication date:

11/12/2024

The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.2. This is due to missing or incorrect nonce validation on the ajax_update_order_note() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

Subscribe to Vulnerabilities