Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-49332
Publication date:
20/05/2024
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.
Severity CVSS v4.0: Pending analysis
Last modification:
09/05/2025

CVE-2023-49333
Publication date:
20/05/2024
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.
Severity CVSS v4.0: Pending analysis
Last modification:
09/05/2025

CVE-2023-49334
Publication date:
20/05/2024
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.
Severity CVSS v4.0: Pending analysis
Last modification:
09/05/2025

CVE-2024-0401
Publication date:
20/05/2024
ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U, ASUS RT-AC67U, ASUS RT-AC68R, ASUS RT-AC68U, ASUS RT-AX86, ASUS RT-AC86U, ASUS RT-AX88U, and ASUS RT-AX3000.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2024

CVE-2024-24294
Publication date:
20/05/2024
A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProperty function of engine.min.js.
Severity CVSS v4.0: Pending analysis
Last modification:
03/07/2024

CVE-2024-34947
Publication date:
20/05/2024
Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack.
Severity CVSS v4.0: Pending analysis
Last modification:
25/03/2025

CVE-2024-34948
Publication date:
20/05/2024
An issue in Quanxun Huiju Network Technology(Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 allows attackers to cause a Denial of Service (DoS) when attempting to make TCP connections.
Severity CVSS v4.0: Pending analysis
Last modification:
15/08/2024

CVE-2024-4151
Publication date:
20/05/2024
An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to manipulate or access sensitive project data, potentially leading to data integrity and confidentiality issues.
Severity CVSS v4.0: Pending analysis
Last modification:
31/01/2025

CVE-2024-2835
Publication date:
20/05/2024
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Enterprise Security Manager and ArcSight Platform. The vulnerability could be remotely exploited.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2024

CVE-2024-34952
Publication date:
20/05/2024
taurusxin ncmdump v1.3.2 was discovered to contain a segmentation violation via the NeteaseCrypt::FixMetadata() function at /src/ncmcrypt.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted .ncm file.
Severity CVSS v4.0: Pending analysis
Last modification:
27/03/2025

CVE-2024-34953
Publication date:
20/05/2024
An issue in taurusxin ncmdump v1.3.2 allows attackers to cause a Denial of Service (DoS) via memory exhaustion by supplying a crafted .ncm file
Severity CVSS v4.0: Pending analysis
Last modification:
03/07/2024

CVE-2024-3482
Publication date:
20/05/2024
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Enterprise Security Manager and ArcSight Platform. The vulnerability could be remotely exploited.
Severity CVSS v4.0: Pending analysis
Last modification:
20/05/2024
Subscribe to Vulnerabilities