Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-23239
Publication date:
05/02/2025
When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.<br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
04/02/2026

CVE-2025-21087
Publication date:
05/02/2025
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization.<br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025

CVE-2025-21091
Publication date:
05/02/2025
When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization.<br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025

CVE-2024-56134
Publication date:
05/02/2025
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.<br /> <br /> This issue affects:<br /> <br /> <br /> <br />  Product <br /> <br /> <br /> <br /> <br /> <br /> Affected Versions <br /> <br /> <br /> <br /> <br /> <br /> LoadMaster <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.55.0 to 7.2.60.1 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.49.0 to 7.2.54.12 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> 7.2.48.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> Multi-Tenant Hypervisor <br /> <br /> <br /> <br /> <br /> <br /> 7.1.35.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> ECS<br /> <br /> <br /> <br /> <br /> <br /> All prior versions to 7.2.60.1 (inclusive)
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2025

CVE-2024-56135
Publication date:
05/02/2025
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.<br /> <br /> This issue affects:<br /> <br /> <br /> <br />  Product <br /> <br /> <br /> <br /> <br /> <br /> Affected Versions <br /> <br /> <br /> <br /> <br /> <br /> LoadMaster <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.55.0 to 7.2.60.1 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.49.0 to 7.2.54.12 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> 7.2.48.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> ECS<br /> <br /> <br /> <br /> <br /> <br /> All prior versions to 7.2.60.1 (inclusive)
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2025

CVE-2025-20029
Publication date:
05/02/2025
Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands.<br /> <br /> <br /> <br /> <br /> Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025

CVE-2025-20045
Publication date:
05/02/2025
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025

CVE-2025-20058
Publication date:
05/02/2025
When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Severity CVSS v4.0: HIGH
Last modification:
21/10/2025

CVE-2024-7595
Publication date:
05/02/2025
GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors.<br /> <br /> This can be considered similar to CVE-2020-10136.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-7596
Publication date:
05/02/2025
Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected network behaviors.<br /> <br /> This can be considered similar to CVE-2020-10136.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-56131
Publication date:
05/02/2025
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.<br /> <br /> This issue affects:<br /> <br /> <br /> <br />  Product <br /> <br /> <br /> <br /> <br /> <br /> Affected Versions <br /> <br /> <br /> <br /> <br /> <br /> LoadMaster <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.55.0 to 7.2.60.1 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.49.0 to 7.2.54.12 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> 7.2.48.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> Multi-Tenant Hypervisor <br /> <br /> <br /> <br /> <br /> <br /> 7.1.35.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> ECS<br /> <br /> <br /> <br /> <br /> <br /> All prior versions to 7.2.60.1 (inclusive)
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2025

CVE-2024-56132
Publication date:
05/02/2025
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.<br /> <br /> This issue affects:<br /> <br /> <br /> <br />  Product <br /> <br /> <br /> <br /> <br /> <br /> Affected Versions <br /> <br /> <br /> <br /> <br /> <br /> LoadMaster <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.55.0 to 7.2.60.1 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> From 7.2.49.0 to 7.2.54.12 (inclusive) <br /> <br /> <br /> <br /> <br /> <br />   <br /> <br /> <br /> <br /> <br /> <br /> 7.2.48.12 and all prior versions <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> ECS<br /> <br /> <br /> <br /> <br /> <br /> All prior versions to 7.2.60.1 (inclusive)
Severity CVSS v4.0: Pending analysis
Last modification:
31/07/2025
Subscribe to Vulnerabilities