Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-17465
Publication date:
22/09/2026
IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper enforcement of storage limits.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-17618
Publication date:
22/09/2026
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-17620
Publication date:
22/09/2026
IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064 IBM Financial Transaction Manager transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2025-36084
Publication date:
22/09/2026
IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-16426
Publication date:
22/09/2026
IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-15915
Publication date:
22/09/2026
IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-16346
Publication date:
22/09/2026
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Severity CVSS v4.0: Pending analysis
Last modification:
06/10/2026

CVE-2025-12767
Publication date:
22/09/2026
IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.
Severity CVSS v4.0: Pending analysis
Last modification:
23/09/2026

CVE-2026-96269
Publication date:
22/09/2026
GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it.
Severity CVSS v4.0: HIGH
Last modification:
24/09/2026

CVE-2026-96260
Publication date:
22/09/2026
Mattermost versions 11.9.x
Severity CVSS v4.0: Pending analysis
Last modification:
07/10/2026

CVE-2026-95814
Publication date:
22/09/2026
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group to access protected cipher data server-side.
Severity CVSS v4.0: HIGH
Last modification:
24/09/2026

CVE-2026-95812
Publication date:
22/09/2026
ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to sanitize cat, sort, and time query parameters. Attackers can craft malicious requests with injected script payloads in these parameters to execute arbitrary JavaScript in victims' browsers under the application origin.
Severity CVSS v4.0: MEDIUM
Last modification:
24/09/2026
Subscribe to Vulnerabilities