Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2019-16414
Publication date:
30/09/2019
A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16743
Publication date:
30/09/2019
eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16744
Publication date:
30/09/2019
eBrigade before 5.0 has evenements.php cid SQL Injection.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16745
Publication date:
30/09/2019
eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-14752
Publication date:
30/09/2019
SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16993
Publication date:
30/09/2019
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16676
Publication date:
30/09/2019
Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a user-supplied string is invoked as a method call.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16992
Publication date:
30/09/2019
The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sign a certain cryptocurrency attestation (that an address at keybase.io can be used for Stellar payments to the user), which might be incompatible with a user's personal position on the semantics of an attestation.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16930
Publication date:
28/09/2019
Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related to mishandling of exceptions during deserialization of note plaintexts. This affects anyone who has disclosed their zaddr to a third party.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16941
Publication date:
28/09/2019
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16935
Publication date:
28/09/2019
The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary JavaScript can be delivered to clients that visit the http URL for this server.
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026

CVE-2019-16925
Publication date:
28/09/2019
Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full access
Severity CVSS v4.0: Pending analysis
Last modification:
17/06/2026
Subscribe to Vulnerabilities