Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-2035
Publication date:
06/03/2025
A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /customer_register.php. The manipulation of the argument name leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
15/10/2025

CVE-2024-52923
Publication date:
06/03/2025
An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of a boundary check during the decoding of DL NAS Transport messages leads to a Denial of Service.
Severity CVSS v4.0: Pending analysis
Last modification:
01/07/2025

CVE-2024-52924
Publication date:
06/03/2025
An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of boundary check during the decoding of Registration Accept messages can lead to out-of-bounds writes on the stack
Severity CVSS v4.0: Pending analysis
Last modification:
01/07/2025

CVE-2025-2032
Publication date:
06/03/2025
A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The manipulation of the argument rename leads to path traversal. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
12/05/2025

CVE-2025-2033
Publication date:
06/03/2025
A vulnerability, which was classified as critical, was found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /user_dashboard/view_donor.php. The manipulation of the argument donor_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity CVSS v4.0: MEDIUM
Last modification:
13/05/2025

CVE-2025-21834
Publication date:
06/03/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> seccomp: passthrough uretprobe systemcall without filtering<br /> <br /> When attaching uretprobes to processes running inside docker, the attached<br /> process is segfaulted when encountering the retprobe.<br /> <br /> The reason is that now that uretprobe is a system call the default seccomp<br /> filters in docker block it as they only allow a specific set of known<br /> syscalls. This is true for other userspace applications which use seccomp<br /> to control their syscall surface.<br /> <br /> Since uretprobe is a "kernel implementation detail" system call which is<br /> not used by userspace application code directly, it is impractical and<br /> there&amp;#39;s very little point in forcing all userspace applications to<br /> explicitly allow it in order to avoid crashing tracked processes.<br /> <br /> Pass this systemcall through seccomp without depending on configuration.<br /> <br /> Note: uretprobe is currently only x86_64 and isn&amp;#39;t expected to ever be<br /> supported in i386.<br /> <br /> [kees: minimized changes for easier backporting, tweaked commit log]
Severity CVSS v4.0: Pending analysis
Last modification:
29/10/2025

CVE-2025-21831
Publication date:
06/03/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1<br /> <br /> commit 9d26d3a8f1b0 ("PCI: Put PCIe ports into D3 during suspend") sets the<br /> policy that all PCIe ports are allowed to use D3. When the system is<br /> suspended if the port is not power manageable by the platform and won&amp;#39;t be<br /> used for wakeup via a PME this sets up the policy for these ports to go<br /> into D3hot.<br /> <br /> This policy generally makes sense from an OSPM perspective but it leads to<br /> problems with wakeup from suspend on the TUXEDO Sirius 16 Gen 1 with a<br /> specific old BIOS. This manifests as a system hang.<br /> <br /> On the affected Device + BIOS combination, add a quirk for the root port of<br /> the problematic controller to ensure that these root ports are not put into<br /> D3hot at suspend.<br /> <br /> This patch is based on<br /> <br /> https://lore.kernel.org/linux-pci/20230708214457.1229-2-mario.limonciello@amd.com<br /> <br /> but with the added condition both in the documentation and in the code to<br /> apply only to the TUXEDO Sirius 16 Gen 1 with a specific old BIOS and only<br /> the affected root ports.
Severity CVSS v4.0: Pending analysis
Last modification:
29/10/2025

CVE-2025-21833
Publication date:
06/03/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE<br /> <br /> There is a WARN_ON_ONCE to catch an unlikely situation when<br /> domain_remove_dev_pasid can&amp;#39;t find the `pasid`. In case it nevertheless<br /> happens we must avoid using a NULL pointer.
Severity CVSS v4.0: Pending analysis
Last modification:
02/11/2025

CVE-2025-21832
Publication date:
06/03/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> block: don&amp;#39;t revert iter for -EIOCBQUEUED<br /> <br /> blkdev_read_iter() has a few odd checks, like gating the position and<br /> count adjustment on whether or not the result is bigger-than-or-equal to<br /> zero (where bigger than makes more sense), and not checking the return<br /> value of blkdev_direct_IO() before doing an iov_iter_revert(). The<br /> latter can lead to attempting to revert with a negative value, which<br /> when passed to iov_iter_revert() as an unsigned value will lead to<br /> throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT.<br /> <br /> Be sane and don&amp;#39;t revert for -EIOCBQUEUED, like what is done in other<br /> spots.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2025-21829
Publication date:
06/03/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"<br /> <br /> The Call Trace is as below:<br /> "<br /> <br /> ? show_regs.cold+0x1a/0x1f<br /> ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]<br /> ? __warn+0x84/0xd0<br /> ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]<br /> ? report_bug+0x105/0x180<br /> ? handle_bug+0x46/0x80<br /> ? exc_invalid_op+0x19/0x70<br /> ? asm_exc_invalid_op+0x1b/0x20<br /> ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]<br /> ? __rxe_cleanup+0x124/0x170 [rdma_rxe]<br /> rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe]<br /> ib_destroy_qp_user+0x118/0x190 [ib_core]<br /> rdma_destroy_qp.cold+0x43/0x5e [rdma_cm]<br /> rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core]<br /> rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server]<br /> process_one_work+0x21d/0x3f0<br /> worker_thread+0x4a/0x3c0<br /> ? process_one_work+0x3f0/0x3f0<br /> kthread+0xf0/0x120<br /> ? kthread_complete_and_exit+0x20/0x20<br /> ret_from_fork+0x22/0x30<br /> <br /> "<br /> When too many rdma resources are allocated, rxe needs more time to<br /> handle these rdma resources. Sometimes with the current timeout, rxe<br /> can not release the rdma resources correctly.<br /> <br /> Compared with other rdma drivers, a bigger timeout is used.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2025-21830
Publication date:
06/03/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> landlock: Handle weird files<br /> <br /> A corrupted filesystem (e.g. bcachefs) might return weird files.<br /> Instead of throwing a warning and allowing access to such file, treat<br /> them as regular files.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-58086
Publication date:
06/03/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/v3d: Stop active perfmon if it is being destroyed<br /> <br /> If the active performance monitor (`v3d-&gt;active_perfmon`) is being<br /> destroyed, stop it first. Currently, the active perfmon is not<br /> stopped during destruction, leaving the `v3d-&gt;active_perfmon` pointer<br /> stale. This can lead to undefined behavior and instability.<br /> <br /> This patch ensures that the active perfmon is stopped before being<br /> destroyed, aligning with the behavior introduced in commit<br /> 7d1fd3638ee3 ("drm/v3d: Stop the active perfmon before being destroyed").
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025
Subscribe to Vulnerabilities