Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-30595

Publication date:

28/03/2024

Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the addWifiMacFilter function.

Severity CVSS v4.0: Pending analysis

Last modification:

13/03/2025

CVE-2024-30421

Publication date:

28/03/2024

Cross-Site Request Forgery (CSRF) vulnerability in Pixelite Events Manager.This issue affects Events Manager: from n/a through 6.4.7.1.

Severity CVSS v4.0: Pending analysis

Last modification:

28/03/2024

CVE-2024-30422

Publication date:

28/03/2024

Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in WPVibes Elementor Addon Elements allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.13.1.

Severity CVSS v4.0: Pending analysis

Last modification:

05/02/2025

CVE-2023-6371

Publication date:

28/03/2024

An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2024

CVE-2024-2818

Publication date:

28/03/2024

An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels.

Severity CVSS v4.0: Pending analysis

Last modification:

11/12/2024

CVE-2023-52628

Publication date:

28/03/2024

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption. This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does. The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added. Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).

Severity CVSS v4.0: Pending analysis

Last modification:

04/11/2025

CVE-2024-2890

Publication date:

28/03/2024

Unrestricted Upload of File with Dangerous Type vulnerability in Tumult Inc. Tumult Hype Animations.This issue affects Tumult Hype Animations: from n/a through 1.9.12.

Severity CVSS v4.0: Pending analysis

Last modification:

28/03/2024

CVE-2024-29241

Publication date:

28/03/2024

Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to obtain non-sensitive information, write sensitive configurations in DSM, and reboot or shutdown NAS via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

12/08/2025

CVE-2024-29240

Publication date:

28/03/2024

Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to conduct limited denial-of-service attacks via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2025

CVE-2024-29239

Publication date:

28/03/2024

Improper neutralization of special elements used in an SQL command (&#39;SQL Injection&#39;) vulnerability in Recording.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2025

CVE-2024-29237

Publication date:

28/03/2024

Improper neutralization of special elements used in an SQL command (&#39;SQL Injection&#39;) vulnerability in ActionRule.Delete webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2025

CVE-2024-29238

Publication date:

28/03/2024

Improper neutralization of special elements used in an SQL command (&#39;SQL Injection&#39;) vulnerability in Log.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Severity CVSS v4.0: Pending analysis

Last modification:

04/08/2025

Subscribe to Vulnerabilities