Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-52536
Publication date:
10/02/2026
Improper Prevention of Lock Bit Modification in SEV firmware could allow a privileged attacker to downgrade firmware potentially resulting in a loss of integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-54514
Publication date:
10/02/2026
Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a partial loss of integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-48514
Publication date:
10/02/2026
Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting in a loss of confidentiality.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-48515
Publication date:
10/02/2026
Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potentially resulting in arbitrary code execution.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-48517
Publication date:
10/02/2026
Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in the range meant for SEV-SNP guests potentially resulting in a partial loss of confidentiality.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29946
Publication date:
10/02/2026
Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU. This can potentially lead to a loss of confidentiality and integrity in guest memory.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29948
Publication date:
10/02/2026
Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass RMP protections, potentially resulting in a loss of SEV-SNP guest memory integrity.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29949
Publication date:
10/02/2026
Insufficient input parameter sanitization in AMD Secure Processor (ASP) Boot Loader (legacy recovery mode only) could allow an attacker to write out-of-bounds to corrupt Secure DRAM potentially resulting in denial of service.
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-29950
Publication date:
10/02/2026
Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution.
Severity CVSS v4.0: HIGH
Last modification:
10/02/2026

CVE-2025-29951
Publication date:
10/02/2026
A buffer overflow in the AMD Secure Processor (ASP) bootloader could allow an attacker to overwrite memory, potentially resulting in privilege escalation and arbitrary code execution.
Severity CVSS v4.0: HIGH
Last modification:
10/02/2026

CVE-2025-29952
Publication date:
10/02/2026
Improper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP covered memory, potentially resulting in loss of guest memory integrity
Severity CVSS v4.0: MEDIUM
Last modification:
10/02/2026

CVE-2025-48509
Publication date:
10/02/2026
Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potentially resulting in a loss of guest memory integrity
Severity CVSS v4.0: LOW
Last modification:
10/02/2026
Subscribe to Vulnerabilities