Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-0338
Publication date:
02/02/2024
A buffer overflow vulnerability has been found in XAMPP affecting version 8.2.4 and earlier. An attacker could execute arbitrary code through a long file debug argument that controls the Structured Exception Handler (SEH).
Severity CVSS v4.0: Pending analysis
Last modification:
09/02/2024

CVE-2024-23895
Publication date:
02/02/2024
A vulnerability has been reported in Cups Easy (Purchase & Inventory), version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via /cupseasylive/locationcreate.php, in the locationid parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
Severity CVSS v4.0: Pending analysis
Last modification:
15/02/2024

CVE-2024-24388
Publication date:
02/02/2024
Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information via crafted malicious requests to the background login.
Severity CVSS v4.0: Pending analysis
Last modification:
05/06/2025

CVE-2023-48645
Publication date:
02/02/2024
An issue was discovered in the Archibus app 4.0.3 for iOS. It uses a local database that is synchronized with a Web central server instance every time the application is opened, or when the refresh button is used. There is a SQL injection in the search work request feature in the Maintenance module of the app. This allows performing queries on the local database.
Severity CVSS v4.0: Pending analysis
Last modification:
03/06/2025

CVE-2024-22851
Publication date:
02/02/2024
Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted request to the /static/ endpoint.
Severity CVSS v4.0: Pending analysis
Last modification:
05/06/2025

CVE-2024-25001
Publication date:
02/02/2024
Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID. ConsultIDs: none. Reason: This CVE ID is unused by its CNA. Notes: none.
Severity CVSS v4.0: Pending analysis
Last modification:
02/02/2024

CVE-2024-24524
Publication date:
02/02/2024
Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.php component.
Severity CVSS v4.0: Pending analysis
Last modification:
03/07/2024

CVE-2021-22281
Publication date:
02/02/2024
: Relative Path Traversal vulnerability in B&amp;R Industrial Automation Automation Studio allows Relative Path Traversal.This issue affects Automation Studio: from 4.0 through 4.12.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
10/02/2024

CVE-2020-24682
Publication date:
02/02/2024
Unquoted Search Path or Element vulnerability in B&amp;R Industrial Automation Automation Studio, B&amp;R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4.<br /> <br />
Severity CVSS v4.0: Pending analysis
Last modification:
10/02/2024

CVE-2024-21863
Publication date:
02/02/2024
<br /> in OpenHarmony v4.0.0 and prior versions allow a local attacker cause DOS through improper input.
Severity CVSS v4.0: Pending analysis
Last modification:
09/09/2024

CVE-2024-23978
Publication date:
02/02/2024
Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that the affected products are no longer supported.
Severity CVSS v4.0: Pending analysis
Last modification:
15/05/2025

CVE-2024-21851
Publication date:
02/02/2024
<br /> in OpenHarmony v4.0.0 and prior versions allow a local attacker cause heap overflow through integer overflow.
Severity CVSS v4.0: Pending analysis
Last modification:
09/09/2024
Subscribe to Vulnerabilities