Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-68166
Publication date:
16/12/2025
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-68165
Publication date:
16/12/2025
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-68164
Publication date:
16/12/2025
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-68163
Publication date:
16/12/2025
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-68162
Publication date:
16/12/2025
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-62329
Publication date:
16/12/2025
HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-64012
Publication date:
16/12/2025
InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-65318
Publication date:
16/12/2025
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-65319
Publication date:
16/12/2025
When using the attachment interaction functionality, Blue Mail 1.140.103 and below saves documents to a file system without a Mark-of-the-Web tag, which allows attackers to bypass the built-in file protection mechanisms of both Windows OS and third-party software.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-65427
Publication date:
16/12/2025
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to /api/login allowing attackers to brute force password enumerations.
Severity CVSS v4.0: Pending analysis
Last modification:
18/12/2025

CVE-2025-10450
Publication date:
16/12/2025
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic.This issue affects Connext Professional: from 7.4.0 before 7.*, from 7.2.0 before 7.3.1.
Severity CVSS v4.0: HIGH
Last modification:
18/12/2025

CVE-2025-14432
Publication date:
16/12/2025
In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes. The affected log file is visible only to users with admin credentials. This is limited to Microsoft TAC and does not affect configuration changes made using the provisioning server or the device WebUI.
Severity CVSS v4.0: HIGH
Last modification:
18/12/2025
Subscribe to Vulnerabilities