Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-9477

Publication date:

13/11/2024

Improper Neutralization of Input During Web Page Generation (XSS or &#39;Cross-site Scripting&#39;) vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting (XSS).This issue affects Air4443 Firmware: through 14102024.<br /> <br /> <br /> NOTE: The vendor was contacted and it was learned that the product classified as End-of-Life and End-of-Support.

Severity CVSS v4.0: MEDIUM

Last modification:

15/11/2024

CVE-2024-50852

Publication date:

13/11/2024

Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2024

CVE-2024-50853

Publication date:

13/11/2024

Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg function.

Severity CVSS v4.0: Pending analysis

Last modification:

14/11/2024

CVE-2024-49506

Publication date:

13/11/2024

Insecure creation of temporary files allows local users on systems with non-default configurations to cause denial of service or set the encryption key for a filesystem

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2024-48510

Publication date:

13/11/2024

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity CVSS v4.0: Pending analysis

Last modification:

02/05/2025

CVE-2024-48900

Publication date:

13/11/2024

A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access lists of those they are intended to have access to.

Severity CVSS v4.0: Pending analysis

Last modification:

13/06/2025

CVE-2024-49505

Publication date:

13/11/2024

A Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in openSUSE Tumbleweed MirrorCache allows the execution of arbitrary JS via reflected XSS in the REGEX and P parameters.<br /> This issue affects MirrorCache before 1.083.

Severity CVSS v4.0: MEDIUM

Last modification:

14/11/2024

CVE-2024-49504

Publication date:

13/11/2024

grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

CVE-2024-11165

Publication date:

13/11/2024

An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leakage within the yb_backup log files, exposing the SAS token in plaintext. The leakage occurs during the backup procedure, leading to potential unauthorized access to resources associated with the SAS token. This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.

Severity CVSS v4.0: MEDIUM

Last modification:

15/04/2026

CVE-2024-11159

Publication date:

13/11/2024

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird

Severity CVSS v4.0: Pending analysis

Last modification:

06/12/2024

CVE-2024-48989

Publication date:

13/11/2024

A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, rendering the device unresponsive by sending arbitrary UDP messages.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2022-45157

Publication date:

13/11/2024

A vulnerability has been identified in the way that Rancher stores vSphere&#39;s CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.

Severity CVSS v4.0: HIGH

Last modification:

15/04/2026

Subscribe to Vulnerabilities