Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-4367

Publication date:

21/08/2023

Rejected reason: Duplicate, use CVE-2023-4279 instead.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2023-40735

Publication date:

21/08/2023

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows loss of plausible deniability and confidentiality.This issue affects BUTTERFLY BUTTON: As of 2023-08-21.

Severity CVSS v4.0: Pending analysis

Last modification:

02/07/2025

CVE-2023-38899

Publication date:

21/08/2023

SQL injection vulnerability in berkaygediz O_Blog v.1.0 allows a local attacker to escalate privileges via the secure_file_priv component.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2020-28715

Publication date:

21/08/2023

An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS).

Severity CVSS v4.0: Pending analysis

Last modification:

26/08/2023

CVE-2023-3481

Publication date:

21/08/2023

Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2023

CVE-2023-4455

Publication date:

21/08/2023

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-4454

Publication date:

21/08/2023

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-4453

Publication date:

21/08/2023

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.

Severity CVSS v4.0: Pending analysis

Last modification:

24/08/2023

CVE-2023-39939

Publication date:

21/08/2023

SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute arbitrary queries against the database and obtain or alter the information in it.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2023

CVE-2023-40068

Publication date:

21/08/2023

Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 allows a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is logging in to the product with the administrative privilege.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2023

CVE-2023-39543

Publication date:

21/08/2023

Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product.

Severity CVSS v4.0: Pending analysis

Last modification:

25/08/2023

CVE-2022-46751

Publication date:

21/08/2023

Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used. This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways. Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed. Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle&#39;s "Java API for XML Processing (JAXP) Security Guide".

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

Subscribe to Vulnerabilities