Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-23415
Publication date:
05/02/2025
An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN client for Windows, macOS and Linux.<br /> <br /> <br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: LOW
Last modification:
12/11/2025

CVE-2025-22846
Publication date:
05/02/2025
When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.<br /> <br /> <br /> <br />   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
10/09/2025

CVE-2025-22891
Publication date:
05/02/2025
When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
06/08/2025

CVE-2025-23412
Publication date:
05/02/2025
When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate.<br /> <br /> <br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
12/11/2025

CVE-2025-23413
Publication date:
05/02/2025
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: MEDIUM
Last modification:
12/11/2025

CVE-2025-23239
Publication date:
05/02/2025
When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.<br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
04/02/2026

CVE-2025-21087
Publication date:
05/02/2025
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization.<br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025

CVE-2025-21091
Publication date:
05/02/2025
When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization.<br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025

CVE-2024-56134
Publication date:
05/02/2025
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.<br /> <br /> This issue affects:<br /> <br /> <br /> <br />  Product <br /> <br /> <br /> <br /> <br /> <br /> Affected Versions <br /> <br /> <br /> <br /> <br /> <br /> LoadMaster <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.55.0 to 7.2.60.1 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.49.0 to 7.2.54.12 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> 7.2.48.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> Multi-Tenant Hypervisor <br /> <br /> <br /> <br /> <br /> <br /> 7.1.35.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> ECS<br /> <br /> <br /> <br /> <br /> <br /> All prior versions to 7.2.60.1 (inclusive)
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2025

CVE-2024-56135
Publication date:
05/02/2025
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.<br /> <br /> This issue affects:<br /> <br /> <br /> <br />  Product <br /> <br /> <br /> <br /> <br /> <br /> Affected Versions <br /> <br /> <br /> <br /> <br /> <br /> LoadMaster <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.55.0 to 7.2.60.1 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.49.0 to 7.2.54.12 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> 7.2.48.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> ECS<br /> <br /> <br /> <br /> <br /> <br /> All prior versions to 7.2.60.1 (inclusive)
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2025

CVE-2025-20029
Publication date:
05/02/2025
Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands.<br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025

CVE-2025-20045
Publication date:
05/02/2025
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025
Subscribe to Vulnerabilities