Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-29946
Publication date:
10/02/2026
Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU. This can potentially lead to a loss of confidentiality and integrity in guest memory.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29948
Publication date:
10/02/2026
Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass RMP protections, potentially resulting in a loss of SEV-SNP guest memory integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29949
Publication date:
10/02/2026
Insufficient input parameter sanitization in AMD Secure Processor (ASP) Boot Loader (legacy recovery mode only) could allow an attacker to write out-of-bounds to corrupt Secure DRAM potentially resulting in denial of service.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29950
Publication date:
10/02/2026
Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.
Severity CVSS v4.0: HIGH
Last modification:
10/02/2026

CVE-2025-29951
Publication date:
10/02/2026
A buffer overflow in the AMD Secure Processor (ASP) bootloader could allow an attacker to overwrite memory, potentially resulting in privilege escalation and arbitrary code execution.
Severity CVSS v4.0: HIGH
Last modification:
10/02/2026

CVE-2025-29952
Publication date:
10/02/2026
Improper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP covered memory, potentially resulting in loss of guest memory integrity
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-48509
Publication date:
10/02/2026
Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity
Severity CVSS v4.0: LOW
Last modification:
10/02/2026

CVE-2025-0012
Publication date:
10/02/2026
Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory could allow a privileged attacker corrupt or partially infer SMM memory resulting in loss of integrity or confidentiality.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-0029
Publication date:
10/02/2026
Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resulting in a loss of SEV-SNP guest memory integrity
Severity CVSS v4.0: LOW
Last modification:
10/02/2026

CVE-2025-0031
Publication date:
10/02/2026
A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than the migration agent potentially resulting in loss of integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29939
Publication date:
10/02/2026
Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) during secure nested paging (SNP) initialization, potentially resulting in a loss of guest memory confidentiality and integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2021-26410
Publication date:
10/02/2026
Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing an attacker to infer the contents of the kernel memory leading to potential information disclosure.
Severity CVSS v4.0: LOW
Last modification:
10/02/2026
Subscribe to Vulnerabilities