Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-0031
Publication date:
10/02/2026
A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than the migration agent potentially resulting in loss of integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29939
Publication date:
10/02/2026
Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) during secure nested paging (SNP) initialization, potentially resulting in a loss of guest memory confidentiality and integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2021-26410
Publication date:
10/02/2026
Improper syscall input validation in ASP (AMD Secure Processor) may force the kernel into reading syscall parameter values from its own memory space allowing an attacker to infer the contents of the kernel memory leading to potential information disclosure.
Severity CVSS v4.0: LOW
Last modification:
10/02/2026

CVE-2024-21953
Publication date:
10/02/2026
Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2024-36310
Publication date:
10/02/2026
Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SMRAM potentially resulting in loss of confidentiality or integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2024-36311
Publication date:
10/02/2026
A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform an out of bounds read or write, potentially resulting in loss of confidentiality, integrity, or availability.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2024-36355
Publication date:
10/02/2026
Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (sleep) wake up, potentially resulting in arbitrary code execution.
Severity CVSS v4.0: HIGH
Last modification:
12/02/2026

CVE-2021-26381
Publication date:
10/02/2026
Improper system call parameter validation in the Trusted OS may allow a malicious driver to perform mapping or unmapping operations on a large number of pages, potentially resulting in kernel memory corruption.
Severity CVSS v4.0: HIGH
Last modification:
10/02/2026

CVE-2026-2302
Publication date:
10/02/2026
Under specific conditions when processing a maliciously crafted value of type Hash r, Mongoid::Criteria.from_hash may allow for executing arbitrary Ruby code.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2026-25610
Publication date:
10/02/2026
An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.
Severity CVSS v4.0: HIGH
Last modification:
10/02/2026

CVE-2026-25613
Publication date:
10/02/2026
An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.
Severity CVSS v4.0: HIGH
Last modification:
10/02/2026

CVE-2026-26009
Publication date:
10/02/2026
Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates execute directly on the host operating system as root via bash -c, with no sandboxing or containerization. Any user with template.create or template.update permission can define arbitrary shell commands that achieve full root-level remote code execution on every node machine in the cluster. This vulnerability is fixed in commit 11980aaf3f46315b02777f325ba02c56b110165d.
Severity CVSS v4.0: Pending analysis
Last modification:
10/02/2026
Subscribe to Vulnerabilities