Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-8320

Publication date:
10/09/2024
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to spoof Network Isolation status of managed devices.
Severity CVSS v4.0: Pending analysis
Last modification:
12/09/2024

CVE-2024-8321

Publication date:
10/09/2024
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to isolate managed devices from the network.
Severity CVSS v4.0: Pending analysis
Last modification:
12/09/2024

CVE-2024-8322

Publication date:
10/09/2024
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker to access restricted functionality.
Severity CVSS v4.0: Pending analysis
Last modification:
12/09/2024

CVE-2024-8441

Publication date:
10/09/2024
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM.
Severity CVSS v4.0: Pending analysis
Last modification:
12/09/2024

CVE-2024-44106

Publication date:
10/09/2024
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
12/06/2025

CVE-2024-44107

Publication date:
10/09/2024
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges and achieve arbitrary code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
12/06/2025

CVE-2024-8012

Publication date:
10/09/2024
An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
12/06/2025

CVE-2024-8190

Publication date:
10/09/2024
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2025

CVE-2024-8191

Publication date:
10/09/2024
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
Severity CVSS v4.0: Pending analysis
Last modification:
12/09/2024

CVE-2024-44103

Publication date:
10/09/2024
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
12/06/2025

CVE-2024-44104

Publication date:
10/09/2024
An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
Severity CVSS v4.0: Pending analysis
Last modification:
12/06/2025

CVE-2024-44105

Publication date:
10/09/2024
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to obtain OS credentials.
Severity CVSS v4.0: Pending analysis
Last modification:
12/06/2025