Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-25552

Publication date:

01/03/2024

A local attacker can gain administrative privileges by inserting an executable file in the path of the affected product.

Severity CVSS v4.0: Pending analysis

Last modification:

04/03/2025

CVE-2024-25553

Publication date:

01/03/2024

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Severity CVSS v4.0: Pending analysis

Last modification:

01/03/2024

CVE-2024-1859

Publication date:

01/03/2024

The Slider Responsive Slideshow – Image slider, Gallery slideshow plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.8 via deserialization of untrusted input to the awl_slider_responsive_shortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Severity CVSS v4.0: Pending analysis

Last modification:

12/03/2025

CVE-2024-22891

Publication date:

01/03/2024

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2025

CVE-2024-25293

Publication date:

01/03/2024

mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.

Severity CVSS v4.0: Pending analysis

Last modification:

13/05/2025

CVE-2024-25386

Publication date:

01/03/2024

Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the format_logfile.pl file.

Severity CVSS v4.0: Pending analysis

Last modification:

16/08/2024

CVE-2023-38366

Publication date:

01/03/2024

IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 261115.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2023-47716

Publication date:

01/03/2024

IBM CP4BA - Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a user to gain the privileges of another user under unusual circumstances. IBM X-Force ID: 271656.

Severity CVSS v4.0: Pending analysis

Last modification:

15/08/2025

CVE-2023-50312

Publication date:

01/03/2024

IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

CVE-2023-28949

Publication date:

01/03/2024

IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 251216.

Severity CVSS v4.0: Pending analysis

Last modification:

07/03/2024

CVE-2023-50305

Publication date:

01/03/2024

IBM Engineering Requirements Management DOORS 9.7.2.7 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 273336.

Severity CVSS v4.0: Pending analysis

Last modification:

07/03/2024

CVE-2023-50324

Publication date:

01/03/2024

IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the application environment to conduct further attacks. IBM X-Force ID: 275038.

Severity CVSS v4.0: Pending analysis

Last modification:

23/04/2025

Subscribe to Vulnerabilities