Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-4143

Publication date:

28/06/2023

An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization

Severity CVSS v4.0: Pending analysis

Last modification:

06/07/2023

CVE-2023-21518

Publication date:

28/06/2023

Improper access control vulnerability in SearchWidget prior to version 3.3 in China models allows untrusted applications to start arbitrary activity.

Severity CVSS v4.0: Pending analysis

Last modification:

06/07/2023

CVE-2023-21513

Publication date:

28/06/2023

Improper privilege management vulnerability in CC Mode prior to SMR Jun-2023 Release 1 allows physical attackers to manipulate device to operate in way that results in unexpected behavior in CC Mode under specific condition.

Severity CVSS v4.0: Pending analysis

Last modification:

05/12/2024

CVE-2023-21517

Publication date:

28/06/2023

Heap out-of-bound write vulnerability in Exynos baseband prior to SMR Jun-2023 Release 1 allows remote attacker to execute arbitrary code.

Severity CVSS v4.0: Pending analysis

Last modification:

07/07/2023

CVE-2023-21512

Publication date:

28/06/2023

Improper Knox ID validation logic in notification framework prior to SMR Jun-2023 Release 1 allows local attackers to read work profile notifications without proper access permission.

Severity CVSS v4.0: Pending analysis

Last modification:

07/07/2023

CVE-2023-3090

Publication date:

28/06/2023

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2023-3389

Publication date:

28/06/2023

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. We recommend upgrading past commit ef7dfac51d8ed961b742218f526bd589f3900a59 (4716c73b188566865bdd79c3a6709696a224ac04 for 5.10 stable and 0e388fce7aec40992eadee654193cad345d62663 for 5.15 stable).

Severity CVSS v4.0: Pending analysis

Last modification:

13/02/2025

CVE-2021-25828

Publication date:

28/06/2023

Emby Server versions

Severity CVSS v4.0: Pending analysis

Last modification:

06/07/2023

CVE-2023-34761

Publication date:

28/06/2023

An unauthenticated attacker within BLE proximity can remotely connect to a 7-Eleven LED Message Cup, Hello Cup 1.3.1 for Android, and bypass the application&#39;s client-side chat censor filter.

Severity CVSS v4.0: Pending analysis

Last modification:

27/11/2024

CVE-2023-33592

Publication date:

28/06/2023

Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_information.

Severity CVSS v4.0: Pending analysis

Last modification:

25/09/2023