Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-41725

Publication date:

25/09/2024

ProGauge MAGLINK LX CONSOLE does not have sufficient filtering on input fields that are used to render pages which may allow cross site scripting.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2024-38324

Publication date:

25/09/2024

IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2024-39928

Publication date:

25/09/2024

In Apache Linkis

Severity CVSS v4.0: Pending analysis

Last modification:

16/05/2025

CVE-2024-21545

Publication date:

25/09/2024

Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with &#39;Sys.Audit&#39; or &#39;VM.Monitor&#39; privileges to download arbitrary host files via the API. When handling the result from a request handler before returning it to the user, the handle_api2_request function will check for the ‘download’ or ‘data’->’download’ objects inside the request handler call response object. If present, handle_api2_request will read a local file defined by this object and return it to the user. Two endpoints were identified which can control the object returned by a request handler sufficiently that the ’download’ object is defined and user controlled. This results in arbitrary file read. The privileges of this file read can result in full compromise of the system by various impacts such as disclosing sensitive files allowing for privileged session forgery.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2023-5359

Publication date:

25/09/2024

The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions. This would not impact the WordPress users site in any way.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

CVE-2023-26691

Publication date:

25/09/2024

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2023-26686

Publication date:

25/09/2024

File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2023-26687

Publication date:

25/09/2024

Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2023-26688

Publication date:

25/09/2024

Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2023-26689

Publication date:

25/09/2024

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2023-26690

Publication date:

25/09/2024

File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu.

Severity CVSS v4.0: Pending analysis

Last modification:

24/04/2025

CVE-2022-43845

Publication date:

25/09/2024

IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.

Severity CVSS v4.0: Pending analysis

Last modification:

30/09/2024

Subscribe to Vulnerabilities