Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2022-46449
Publication date:
10/01/2023
An issue in MPD (Music Player Daemon) v0.23.10 allows attackers to cause a Denial of Service (DoS) via a crafted input.
Severity CVSS v4.0: Pending analysis
Last modification:
09/04/2025

CVE-2022-4337
Publication date:
10/01/2023
An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.
Severity CVSS v4.0: Pending analysis
Last modification:
26/11/2023

CVE-2023-22479
Publication date:
10/01/2023
KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2023

CVE-2023-22469
Publication date:
10/01/2023
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There are currently no known workarounds. It is recommended that the Nextcloud app Deck is upgraded to 1.8.2.<br />
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2022-45167
Publication date:
10/01/2023
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to access the profile information of all connected users.
Severity CVSS v4.0: Pending analysis
Last modification:
30/05/2025

CVE-2022-45166
Publication date:
10/01/2023
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used to act on the data returned to the user. It allows a basic user to access data unrelated to their role.
Severity CVSS v4.0: Pending analysis
Last modification:
30/05/2025

CVE-2022-45164
Publication date:
10/01/2023
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to cancel (delete) a booking, created by someone else - even if this basic user is not a member of the booking
Severity CVSS v4.0: Pending analysis
Last modification:
30/05/2025

CVE-2022-38482
Publication date:
10/01/2023
A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.
Severity CVSS v4.0: Pending analysis
Last modification:
30/05/2025

CVE-2022-38481
Publication date:
10/01/2023
An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features.
Severity CVSS v4.0: Pending analysis
Last modification:
30/05/2025

CVE-2022-45165
Publication date:
10/01/2023
An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a user-controlled parameter that is used to create an SQL query. It causes this service to be prone to SQL injection.
Severity CVSS v4.0: Pending analysis
Last modification:
30/05/2025

CVE-2022-38489
Publication date:
10/01/2023
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1.02 fixes the vulnerably.
Severity CVSS v4.0: Pending analysis
Last modification:
09/04/2025

CVE-2022-38490
Publication date:
10/01/2023
An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 corrects this issue.
Severity CVSS v4.0: Pending analysis
Last modification:
09/04/2025
Subscribe to Vulnerabilities