Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-28164

Publication date:

11/06/2024

SAP NetWeaver AS Java (CAF - Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

06/08/2024

CVE-2024-0627

Publication date:

11/06/2024

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2024-0653

Publication date:

11/06/2024

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2023-6745

Publication date:

11/06/2024

The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s &#39;cpt&#39; shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2023-6748

Publication date:

11/06/2024

The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the &#39;cft&#39; shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata.

Severity CVSS v4.0: Pending analysis

Last modification:

08/04/2026

CVE-2024-37177

Publication date:

11/06/2024

SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and integrity of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-37178

Publication date:

11/06/2024

SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application.

Severity CVSS v4.0: Pending analysis

Last modification:

15/04/2026

CVE-2024-37130

Publication date:

11/06/2024

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and escalate their privilege to the admin user and gain full control of the machine. Exploitation may lead to a complete system compromise.

Severity CVSS v4.0: Pending analysis

Last modification:

09/01/2025

CVE-2024-22261

Publication date:

11/06/2024

SQL-Injection in Harbor allows priviledge users to leak the task IDs

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2025

CVE-2024-22244

Publication date:

10/06/2024

Open Redirect in Harbor

Severity CVSS v4.0: Pending analysis

Last modification:

26/02/2025

CVE-2022-37019

Publication date:

10/06/2024

Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.

Severity CVSS v4.0: Pending analysis

Last modification:

14/01/2026

CVE-2022-37020

Publication date:

10/06/2024

Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2026

Subscribe to Vulnerabilities