Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-21333

Publication date:

26/03/2021

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.

Severity CVSS v4.0: Pending analysis

Last modification:

07/11/2023

CVE-2021-25372

Publication date:

26/03/2021

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2021-25371

Publication date:

26/03/2021

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2021-25370

Publication date:

26/03/2021

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2021-25369

Publication date:

26/03/2021

An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.

Severity CVSS v4.0: Pending analysis

Last modification:

30/10/2025

CVE-2021-22886

Publication date:

26/03/2021

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

Severity CVSS v4.0: Pending analysis

Last modification:

30/03/2021

CVE-2021-29255

Publication date:

26/03/2021

MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007. An attacker on the same network as the device can capture these credentials.

Severity CVSS v4.0: Pending analysis

Last modification:

02/04/2021

CVE-2021-21403

Publication date:

26/03/2021

In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is fixed in version 1.3.21.

Severity CVSS v4.0: Pending analysis

Last modification:

24/10/2022

CVE-2020-28695

Publication date:

26/03/2021

Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH, leading to code execution as root.

Severity CVSS v4.0: Pending analysis

Last modification:

12/07/2022

CVE-2021-20289

Publication date:

26/03/2021

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method&#39;s parameter value. The highest threat from this vulnerability is to data confidentiality.

Severity CVSS v4.0: Pending analysis

Last modification:

10/05/2022

CVE-2021-20271

Publication date:

26/03/2021

A flaw was found in RPM&#39;s signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

CVE-2021-20284

Publication date:

26/03/2021

A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The highest threat from this vulnerability is to system availability.

Severity CVSS v4.0: Pending analysis

Last modification:

12/02/2023

Subscribe to Vulnerabilities