Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2023-34829

Publication date:

28/12/2023

Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.

Severity CVSS v4.0: Pending analysis

Last modification:

17/04/2025

CVE-2023-7123

Publication date:

28/12/2023

A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This issue affects some unknown processing of the file /classes/Master.php? f=save_medicine. The manipulation of the argument id/name/description leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249095.

Severity CVSS v4.0: Pending analysis

Last modification:

23/01/2026

CVE-2023-6879

Publication date:

27/12/2023

Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-46918

Publication date:

27/12/2023

Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an attacker with physical access to the device.

Severity CVSS v4.0: Pending analysis

Last modification:

05/01/2024

CVE-2023-49000

Publication date:

27/12/2023

An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.IntentReceiverActivity component. NOTE: this is disputed by the vendor, who indicates that ArtisBrowser 34 does not support CSS3.

Severity CVSS v4.0: Pending analysis

Last modification:

20/09/2024

CVE-2023-49001

Publication date:

27/12/2023

An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrowswer.webview component.

Severity CVSS v4.0: Pending analysis

Last modification:

09/09/2024

CVE-2023-49002

Publication date:

27/12/2023

An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via interaction with com.funprime.calldialer.ui.activities.OutgoingActivity.

Severity CVSS v4.0: Pending analysis

Last modification:

05/01/2024

CVE-2023-49003

Publication date:

27/12/2023

An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity.

Severity CVSS v4.0: Pending analysis

Last modification:

04/01/2024

CVE-2023-43955

Publication date:

27/12/2023

The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.

Severity CVSS v4.0: Pending analysis

Last modification:

09/01/2024

CVE-2023-46919

Publication date:

27/12/2023

Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K (AES) encryption key. An attacker with physical access to the application&#39;s source code or binary can extract this key & use it decrypt the TLS secret.

Severity CVSS v4.0: Pending analysis

Last modification:

01/10/2024

CVE-2023-47882

Publication date:

27/12/2023

The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.

Severity CVSS v4.0: Pending analysis

Last modification:

09/01/2024

CVE-2023-47883

Publication date:

27/12/2023

The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity.

Severity CVSS v4.0: Pending analysis

Last modification:

09/01/2024

Subscribe to Vulnerabilities