Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-61144
Publication date:
23/02/2026
libtiff up to v4.7.1 was discovered to contain a stack overflow via the readSeparateStripsIntoBuffer function.
Severity CVSS v4.0: Pending analysis
Last modification:
24/02/2026

CVE-2025-61145
Publication date:
23/02/2026
libtiff up to v4.7.1 was discovered to contain a double free via the component tools/tiffcrop.c.
Severity CVSS v4.0: Pending analysis
Last modification:
24/02/2026

CVE-2025-61146
Publication date:
23/02/2026
saitoha libsixel until v1.8.7 was discovered to contain a memory leak via the component malloc_stub.c.
Severity CVSS v4.0: Pending analysis
Last modification:
24/02/2026

CVE-2026-26464
Publication date:
23/02/2026
Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, which allows remote attackers to inject and store arbitrary JavaScript code that is executed in users' browsers. This vulnerability can be exploited via the name parameter in a POST HTTP request, leading to execution of malicious scripts when the affected content is viewed by other users, including administrators.
Severity CVSS v4.0: Pending analysis
Last modification:
24/02/2026

CVE-2026-2698
Publication date:
23/02/2026
An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.
Severity CVSS v4.0: MEDIUM
Last modification:
23/02/2026

CVE-2026-27514
Publication date:
23/02/2026
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality. The configuration download response includes the router password and administrative password in plaintext. The endpoint also omits appropriate Cache-Control directives, which can allow the response to be stored in client-side caches and recovered by other local users or processes with access to cached browser data.
Severity CVSS v4.0: HIGH
Last modification:
23/02/2026

CVE-2026-22568
Publication date:
23/02/2026
Improper neutralization of special elements in user-supplied input within the ZIA Admin UI could allow an authenticated administrator to access or retrieve unauthorized internal information in rare conditions.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2026-27513
Publication date:
23/02/2026
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a cross-site request forgery (CSRF) vulnerability in the web-based administrative interface. The interface does not implement anti-CSRF protections, allowing an attacker to induce an authenticated administrator to submit state-changing requests, which can result in unauthorized configuration changes.
Severity CVSS v4.0: MEDIUM
Last modification:
23/02/2026

CVE-2026-27512
Publication date:
23/02/2026
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a content-type confusion vulnerability in the administrative interface. Responses omit the X-Content-Type-Options: nosniff header and include attacker-influenced content that can be reflected into the response body. Under affected browser behaviors, MIME sniffing may cause the response to be interpreted as active HTML, enabling script execution in the context of the administrative interface.
Severity CVSS v4.0: MEDIUM
Last modification:
23/02/2026

CVE-2026-27511
Publication date:
23/02/2026
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a clickjacking vulnerability in the web-based administrative interface. The interface does not set the X-Frame-Options header, allowing attacker-controlled sites to embed administrative pages in an iframe and trick an authenticated administrator into unintended interactions that may result in unauthorized configuration changes.
Severity CVSS v4.0: MEDIUM
Last modification:
23/02/2026

CVE-2026-22567
Publication date:
23/02/2026
Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.
Severity CVSS v4.0: Pending analysis
Last modification:
23/02/2026

CVE-2026-3016
Publication date:
23/02/2026
A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. The affected element is the function strcpy of the file /goform/formP2PLimitConfig. The manipulation of the argument except leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Severity CVSS v4.0: HIGH
Last modification:
23/02/2026
Subscribe to Vulnerabilities