Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-48509

Publication date:

10/02/2026

Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity

Severity CVSS v4.0: LOW

Last modification:

10/02/2026

CVE-2025-0012

Publication date:

10/02/2026

Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory could allow a privileged attacker corrupt or partially infer SMM memory resulting in loss of integrity or confidentiality.

Severity CVSS v4.0: MEDIUM

Last modification:

10/02/2026

CVE-2025-0029

Publication date:

10/02/2026

Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resulting in a loss of SEV-SNP guest memory integrity

Severity CVSS v4.0: LOW

Last modification:

10/02/2026

CVE-2025-0031

Publication date:

10/02/2026

A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than the migration agent potentially resulting in loss of integrity.

Severity CVSS v4.0: MEDIUM

Last modification:

10/02/2026

CVE-2025-29939

Publication date:

10/02/2026

Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) during secure nested paging (SNP) initialization, potentially resulting in a loss of guest memory confidentiality and integrity.

Severity CVSS v4.0: MEDIUM

Last modification:

10/02/2026

CVE-2021-26410

Publication date:

10/02/2026

Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing an attacker to infer the contents of the kernel memory leading to potential information disclosure.

Severity CVSS v4.0: LOW

Last modification:

10/02/2026

CVE-2024-21953

Publication date:

10/02/2026

Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integrity.

Severity CVSS v4.0: MEDIUM

Last modification:

10/02/2026

CVE-2024-36310

Publication date:

10/02/2026

Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SMRAM potentially resulting in loss of confidentiality or integrity.

Severity CVSS v4.0: MEDIUM

Last modification:

10/02/2026

CVE-2024-36311

Publication date:

10/02/2026

A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform an out of bounds read or write, potentially resulting in loss of confidentiality, integrity, or availability.

Severity CVSS v4.0: MEDIUM

Last modification:

10/02/2026

CVE-2024-36355

Publication date:

10/02/2026

Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (sleep) wake up, potentially resulting in arbitrary code execution.

Severity CVSS v4.0: HIGH

Last modification:

10/02/2026

CVE-2021-26381

Publication date:

10/02/2026

Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a large number of pages, potentially resulting in kernel memory corruption.

Severity CVSS v4.0: HIGH

Last modification:

10/02/2026