Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-3624

Publication date:

25/04/2024

A flaw was found in how Quay&#39;s database is stored in plain-text in mirror-registry on the jinja&#39;s config.yaml file. This flaw allows a malicious actor with access to this file to gain access to Quay&#39;s database.

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2024

CVE-2024-3625

Publication date:

25/04/2024

A flaw was found in Quay, where Quay&#39;s database is stored in plain text in mirror-registry on Jinja&#39;s config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay&#39;s Redis instance.

Severity CVSS v4.0: Pending analysis

Last modification:

26/04/2024

CVE-2024-32648

Publication date:

25/04/2024

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don&#39;t respect nonreentrancy keys and the lock isn&#39;t emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3.0 contains a patch for the issue.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

02/01/2025

CVE-2024-32649

Publication date:

25/04/2024

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn&#39;t cache the argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

02/01/2025

CVE-2024-3508

Publication date:

25/04/2024

A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.

Severity CVSS v4.0: Pending analysis

Last modification:

18/06/2025

CVE-2024-3622

Publication date:

25/04/2024

A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same secret key. This flaw allows a malicious actor to craft session cookies and as a consequence, it may lead to gaining access to the affected Quay instance.

Severity CVSS v4.0: Pending analysis

Last modification:

30/07/2025

CVE-2024-3623

Publication date:

25/04/2024

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in plain-text format in one of the configuration template files. This issue may lead to all instances of Quay deployed using mirror-registry to have the same database secret key. This flaw allows a malicious actor to access sensitive information from Quay&#39;s database.

Severity CVSS v4.0: Pending analysis

Last modification:

21/01/2026

CVE-2024-32645

Publication date:

25/04/2024

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available.

Severity CVSS v4.0: Pending analysis

Last modification:

02/01/2025

CVE-2024-32646

Publication date:

25/04/2024

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the versions `

Severity CVSS v4.0: Pending analysis

Last modification:

02/01/2025

CVE-2024-32647

Publication date:

25/04/2024

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn&#39;t cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist.<br />

Severity CVSS v4.0: Pending analysis

Last modification:

02/01/2025

CVE-2024-2905

Publication date:

25/04/2024

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2024-32358

Publication date:

25/04/2024

An issue in Jpress v.5.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the custom plug-in module function, a different vulnerability than CVE-2024-43033.

Severity CVSS v4.0: Pending analysis

Last modification:

03/06/2025

Subscribe to Vulnerabilities