Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-44569
Publication date:
03/11/2023
A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.
Severity CVSS v4.0: Pending analysis
Last modification:
05/09/2024

CVE-2023-3893
Publication date:
03/11/2023
A security issue was discovered in Kubernetes where a user that can <br /> create pods on Windows nodes running kubernetes-csi-proxy may be able to<br /> escalate to admin privileges on those nodes. Kubernetes clusters are <br /> only affected if they include Windows nodes running <br /> kubernetes-csi-proxy.
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2025

CVE-2023-23368
Publication date:
03/11/2023
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> QTS 5.0.1.2376 build 20230421 and later<br /> QTS 4.5.4.2374 build 20230416 and later<br /> QuTS hero h5.0.1.2376 build 20230421 and later<br /> QuTS hero h4.5.4.2374 build 20230417 and later<br /> QuTScloud c5.0.1.2374 and later<br />
Severity CVSS v4.0: Pending analysis
Last modification:
15/11/2023

CVE-2023-23369
Publication date:
03/11/2023
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> Multimedia Console 2.1.2 ( 2023/05/04 ) and later<br /> Multimedia Console 1.4.8 ( 2023/05/05 ) and later<br /> QTS 5.1.0.2399 build 20230515 and later<br /> QTS 4.3.6.2441 build 20230621 and later<br /> QTS 4.3.4.2451 build 20230621 and later<br /> QTS 4.3.3.2420 build 20230621 and later<br /> QTS 4.2.6 build 20230621 and later<br /> Media Streaming add-on 500.1.1.2 ( 2023/06/12 ) and later<br /> Media Streaming add-on 500.0.0.11 ( 2023/06/16 ) and later<br />
Severity CVSS v4.0: Pending analysis
Last modification:
15/11/2023

CVE-2023-25700
Publication date:
03/11/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/09/2024

CVE-2023-25800
Publication date:
03/11/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/09/2024

CVE-2023-25990
Publication date:
03/11/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/09/2024

CVE-2023-32121
Publication date:
03/11/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injection.This issue affects Zero Spam for WordPress: from n/a through 5.4.4.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
19/02/2025

CVE-2023-32508
Publication date:
03/11/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in Rolf van Gelder Order Your Posts Manually allows SQL Injection.This issue affects Order Your Posts Manually: from n/a through 2.2.5.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/09/2024

CVE-2023-34179
Publication date:
03/11/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in Groundhogg Inc. Groundhogg allows SQL Injection.This issue affects Groundhogg: from n/a through 2.7.11.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
05/09/2024

CVE-2023-36529
Publication date:
03/11/2023
Improper Neutralization of Special Elements used in an SQL Command (&amp;#39;SQL Injection&amp;#39;) vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
19/02/2025

CVE-2023-39299
Publication date:
03/11/2023
A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network.<br /> <br /> We have already fixed the vulnerability in the following versions:<br /> Music Station 4.8.11 and later<br /> Music Station 5.1.16 and later<br /> Music Station 5.3.23 and later<br />
Severity CVSS v4.0: Pending analysis
Last modification:
14/11/2023
Subscribe to Vulnerabilities