Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-41076
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> NFSv4: Fix memory leak in nfs4_set_security_label<br /> <br /> We leak nfs_fattr and nfs4_label every time we set a security xattr.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41077
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> null_blk: fix validation of block size<br /> <br /> Block size should be between 512 and PAGE_SIZE and be a power of 2. The current<br /> check does not validate this, so update the check.<br /> <br /> Without this patch, null_blk would Oops due to a null pointer deref when<br /> loaded with bs=1536 [1].<br /> <br /> <br /> [axboe: remove unnecessary braces and != 0 check]
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41078
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: qgroup: fix quota root leak after quota disable failure<br /> <br /> If during the quota disable we fail when cleaning the quota tree or when<br /> deleting the root from the root tree, we jump to the &amp;#39;out&amp;#39; label without<br /> ever dropping the reference on the quota root, resulting in a leak of the<br /> root since fs_info-&gt;quota_root is no longer pointing to the root (we have<br /> set it to NULL just before those steps).<br /> <br /> Fix this by always doing a btrfs_put_root() call under the &amp;#39;out&amp;#39; label.<br /> This is a problem that exists since qgroups were first added in 2012 by<br /> commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but<br /> back then we missed a kfree on the quota root and free_extent_buffer()<br /> calls on its root and commit root nodes, since back then roots were not<br /> yet reference counted.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41080
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> io_uring: fix possible deadlock in io_register_iowq_max_workers()<br /> <br /> The io_register_iowq_max_workers() function calls io_put_sq_data(),<br /> which acquires the sqd-&gt;lock without releasing the uring_lock.<br /> Similar to the commit 009ad9f0c6ee ("io_uring: drop ctx-&gt;uring_lock<br /> before acquiring sqd-&gt;lock"), this can lead to a potential deadlock<br /> situation.<br /> <br /> To resolve this issue, the uring_lock is released before calling<br /> io_put_sq_data(), and then it is re-acquired after the function call.<br /> <br /> This change ensures that the locks are acquired in the correct<br /> order, preventing the possibility of a deadlock.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41082
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvme-fabrics: use reserved tag for reg read/write command<br /> <br /> In some scenarios, if too many commands are issued by nvme command in<br /> the same time by user tasks, this may exhaust all tags of admin_q. If<br /> a reset (nvme reset or IO timeout) occurs before these commands finish,<br /> reconnect routine may fail to update nvme regs due to insufficient tags,<br /> which will cause kernel hang forever. In order to workaround this issue,<br /> maybe we can let reg_read32()/reg_read64()/reg_write32() use reserved<br /> tags. This maybe safe for nvmf:<br /> <br /> 1. For the disable ctrl path, we will not issue connect command<br /> 2. For the enable ctrl / fw activate path, since connect and reg_xx()<br /> are called serially.<br /> <br /> So the reserved tags may still be enough while reg_xx() use reserved tags.
Severity CVSS v4.0: Pending analysis
Last modification:
09/10/2025

CVE-2024-41671
Publication date:
29/07/2024
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.
Severity CVSS v4.0: Pending analysis
Last modification:
15/04/2026

CVE-2024-41073
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvme: avoid double free special payload<br /> <br /> If a discard request needs to be retried, and that retry may fail before<br /> a new special payload is added, a double free will result. Clear the<br /> RQF_SPECIAL_LOAD when the request is cleaned.
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2026

CVE-2024-41075
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cachefiles: add consistency check for copen/cread<br /> <br /> This prevents malicious processes from completing random copen/cread<br /> requests and crashing the system. Added checks are listed below:<br /> <br /> * Generic, copen can only complete open requests, and cread can only<br /> complete read requests.<br /> * For copen, ondemand_id must not be 0, because this indicates that the<br /> request has not been read by the daemon.<br /> * For cread, the object corresponding to fd and req should be the same.
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2026

CVE-2024-41079
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmet: always initialize cqe.result<br /> <br /> The spec doesn&amp;#39;t mandate that the first two double words (aka results)<br /> for the command queue entry need to be set to 0 when they are not<br /> used (not specified). Though, the target implemention returns 0 for TCP<br /> and FC but not for RDMA.<br /> <br /> Let&amp;#39;s make RDMA behave the same and thus explicitly initializing the<br /> result field. This prevents leaking any data from the stack.
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2026

CVE-2024-41081
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ila: block BH in ila_output()<br /> <br /> As explained in commit 1378817486d6 ("tipc: block BH<br /> before using dst_cache"), net/core/dst_cache.c<br /> helpers need to be called with BH disabled.<br /> <br /> ila_output() is called from lwtunnel_output()<br /> possibly from process context, and under rcu_read_lock().<br /> <br /> We might be interrupted by a softirq, re-enter ila_output()<br /> and corrupt dst_cache data structures.<br /> <br /> Fix the race by using local_bh_disable().
Severity CVSS v4.0: Pending analysis
Last modification:
04/08/2026

CVE-2024-41061
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport<br /> <br /> [Why]<br /> Potential out of bounds access in dml2_calculate_rq_and_dlg_params()<br /> because the value of out_lowest_state_idx used as an index for FCLKChangeSupport<br /> array can be greater than 1.<br /> <br /> [How]<br /> Currently dml2 core specifies identical values for all FCLKChangeSupport<br /> elements. Always use index 0 in the condition to avoid out of bounds access.
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2026

CVE-2024-41063
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_core: cancel all works upon hci_unregister_dev()<br /> <br /> syzbot is reporting that calling hci_release_dev() from hci_error_reset()<br /> due to hci_dev_put() from hci_error_reset() can cause deadlock at<br /> destroy_workqueue(), for hci_error_reset() is called from<br /> hdev-&gt;req_workqueue which destroy_workqueue() needs to flush.<br /> <br /> We need to make sure that hdev-&gt;{rx_work,cmd_work,tx_work} which are<br /> queued into hdev-&gt;workqueue and hdev-&gt;{power_on,error_reset} which are<br /> queued into hdev-&gt;req_workqueue are no longer running by the moment<br /> <br /> destroy_workqueue(hdev-&gt;workqueue);<br /> destroy_workqueue(hdev-&gt;req_workqueue);<br /> <br /> are called from hci_release_dev().<br /> <br /> Call cancel_work_sync() on these work items from hci_unregister_dev()<br /> as soon as hdev-&gt;list is removed from hci_dev_list.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025
Subscribe to Vulnerabilities