Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-53966

Publication date:

22/12/2025

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash the application.

Severity CVSS v4.0: CRITICAL

Last modification:

31/12/2025

CVE-2023-53965

Publication date:

22/12/2025

SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during service startup.

Severity CVSS v4.0: HIGH

Last modification:

29/01/2026

CVE-2023-53963

Publication date:

22/12/2025

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the &#39;password&#39; parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the &#39;password&#39; POST parameter to execute commands with web server privileges.

Severity CVSS v4.0: CRITICAL

Last modification:

13/01/2026

CVE-2023-53960

Publication date:

22/12/2025

SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the &#39;index.php&#39; authentication mechanism that allows attackers to manipulate login credentials. Attackers can inject malicious SQL code through the &#39;password&#39; POST parameter to bypass authentication and potentially gain unauthorized access to the system.

Severity CVSS v4.0: CRITICAL

Last modification:

16/01/2026

CVE-2023-53961

Publication date:

22/12/2025

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages that submit HTTP requests to the radio processing interface, triggering unintended administrative operations when a logged-in user visits the page.

Severity CVSS v4.0: MEDIUM

Last modification:

16/01/2026

CVE-2023-53962

Publication date:

22/12/2025

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated directory traversal vulnerability that allows remote attackers to write arbitrary files through the &#39;upgfile&#39; parameter in upload.cgi. Attackers can exploit the vulnerability by sending crafted multipart form-data POST requests with directory traversal sequences to write files to unintended system locations.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

CVE-2023-53964

Publication date:

22/12/2025

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endpoint that allows remote attackers to reset device configuration. Attackers can send a POST request to the endpoint with specific data to trigger a factory reset and bypass authentication, gaining full system control.

Severity CVSS v4.0: HIGH

Last modification:

16/01/2026

CVE-2022-50688

Publication date:

22/12/2025

Cobian Backup Gravity 11.2.0.582 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path in the CobianBackup11 service to inject malicious code that would execute with LocalSystem privileges during service startup.

Severity CVSS v4.0: HIGH

Last modification:

23/12/2025

CVE-2022-50690

Publication date:

22/12/2025

Wondershare MirrorGo 2.0.11.346 contains a local privilege escalation vulnerability due to incorrect file permissions on executable files. Unprivileged local users can replace the ElevationService.exe with a malicious file to execute arbitrary code with LocalSystem privileges.

Severity CVSS v4.0: HIGH

Last modification:

23/12/2025

CVE-2021-47715

Publication date:

22/12/2025

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially access internal network resources.

Severity CVSS v4.0: MEDIUM

Last modification:

26/12/2025

CVE-2022-50689

Publication date:

22/12/2025

Cobian Reflector 0.9.93 RC1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the password input field. Attackers can paste a large 8000-byte buffer into the password field to trigger an application crash during SFTP task configuration.

Severity CVSS v4.0: MEDIUM

Last modification:

31/12/2025

CVE-2022-50687

Publication date:

22/12/2025

Cobian Backup 11 Gravity 11.2.0.582 contains a denial of service vulnerability in the FTP password input field that allows attackers to crash the application. Attackers can generate a specially crafted 800-byte buffer and paste it into the password field to trigger an application crash.

Severity CVSS v4.0: MEDIUM

Last modification:

05/01/2026

Subscribe to Vulnerabilities