Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-47848

Publication date:

05/10/2024

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

CVE-2024-47913

Publication date:

04/10/2024

An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.

Severity CVSS v4.0: Pending analysis

Last modification:

17/06/2025

CVE-2024-37868

Publication date:

04/10/2024

File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "sendreply.php" file, and the uploaded file was received using the "$- FILES" variable.

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2024

CVE-2024-37869

Publication date:

04/10/2024

File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "poster.php" file, and the uploaded file was received using the "$- FILES" variable

Severity CVSS v4.0: Pending analysis

Last modification:

08/10/2024

CVE-2024-47910

Publication date:

04/10/2024

An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can modify an existing configuration of a GitHub integration to exfiltrate a pre-signed JWT.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

CVE-2024-47911

Publication date:

04/10/2024

In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint that allows SonarQube users with the administrator role to inject blind SQL commands.

Severity CVSS v4.0: Pending analysis

Last modification:

04/09/2025

CVE-2024-43687

Publication date:

04/10/2024

Improper Neutralization of Input During Web Page Generation (XSS or &#39;Cross-site Scripting&#39;) vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Severity CVSS v4.0: HIGH

Last modification:

16/10/2024

CVE-2024-47764

Publication date:

04/10/2024

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.

Severity CVSS v4.0: Pending analysis

Last modification:

07/10/2024

CVE-2024-7801

Publication date:

04/10/2024

Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Severity CVSS v4.0: MEDIUM

Last modification:

17/10/2024

CVE-2024-9054

Publication date:

04/10/2024

Improper Neutralization of Special Elements used in an OS Command (&#39;OS Command Injection&#39;), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Severity CVSS v4.0: HIGH

Last modification:

29/09/2025

CVE-2024-43683

Publication date:

04/10/2024

URL Redirection to Untrusted Site (&#39;Open Redirect&#39;) vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0.

Severity CVSS v4.0: HIGH

Last modification:

01/11/2024

CVE-2024-43684

Publication date:

04/10/2024

Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0.

Severity CVSS v4.0: HIGH

Last modification:

01/11/2024

Subscribe to Vulnerabilities