Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-41028
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> platform/x86: toshiba_acpi: Fix array out-of-bounds access<br /> <br /> In order to use toshiba_dmi_quirks[] together with the standard DMI<br /> matching functions, it must be terminated by a empty entry.<br /> <br /> Since this entry is missing, an array out-of-bounds access occurs<br /> every time the quirk list is processed.<br /> <br /> Fix this by adding the terminating empty entry.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41030
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: discard write access to the directory open<br /> <br /> may_open() does not allow a directory to be opened with the write access.<br /> However, some writing flags set by client result in adding write access<br /> on server, making ksmbd incompatible with FUSE file system. Simply, let&amp;#39;s<br /> discard the write access when opening a directory.<br /> <br /> list_add corruption. next is NULL.<br /> ------------[ cut here ]------------<br /> kernel BUG at lib/list_debug.c:26!<br /> pc : __list_add_valid+0x88/0xbc<br /> lr : __list_add_valid+0x88/0xbc<br /> Call trace:<br /> __list_add_valid+0x88/0xbc<br /> fuse_finish_open+0x11c/0x170<br /> fuse_open_common+0x284/0x5e8<br /> fuse_dir_open+0x14/0x24<br /> do_dentry_open+0x2a4/0x4e0<br /> dentry_open+0x50/0x80<br /> smb2_open+0xbe4/0x15a4<br /> handle_ksmbd_work+0x478/0x5ec<br /> process_one_work+0x1b4/0x448<br /> worker_thread+0x25c/0x430<br /> kthread+0x104/0x1d4<br /> ret_from_fork+0x10/0x20
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41034
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nilfs2: fix kernel bug on rename operation of broken directory<br /> <br /> Syzbot reported that in rename directory operation on broken directory on<br /> nilfs2, __block_write_begin_int() called to prepare block write may fail<br /> BUG_ON check for access exceeding the folio/page size.<br /> <br /> This is because nilfs_dotdot(), which gets parent directory reference<br /> entry ("..") of the directory to be moved or renamed, does not check<br /> consistency enough, and may return location exceeding folio/page size for<br /> broken directories.<br /> <br /> Fix this issue by checking required directory entries ("." and "..") in<br /> the first chunk of the directory in nilfs_dotdot().
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41033
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> cachestat: do not flush stats in recency check<br /> <br /> syzbot detects that cachestat() is flushing stats, which can sleep, in its<br /> RCU read section (see [1]). This is done in the workingset_test_recent()<br /> step (which checks if the folio&amp;#39;s eviction is recent).<br /> <br /> Move the stat flushing step to before the RCU read section of cachestat,<br /> and skip stat flushing during the recency check.<br /> <br /> [1]: https://lore.kernel.org/cgroups/000000000000f71227061bdf97e0@google.com/
Severity CVSS v4.0: Pending analysis
Last modification:
24/11/2025

CVE-2024-37906
Publication date:
29/07/2024
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.9, there is an SQL Injection in the `/adm_program/modules/ecards/ecard_send.php` source file of the Admidio Application. The SQL Injection results in a compromise of the application&amp;#39;s database. The value of `ecard_recipients `POST parameter is being directly concatenated with the SQL query in the source code causing the SQL Injection. The SQL Injection can be exploited by a member user, using blind condition-based, time-based, and Out of band interaction SQL Injection payloads. This vulnerability is fixed in 4.3.9.
Severity CVSS v4.0: Pending analysis
Last modification:
29/07/2024

CVE-2024-38529
Publication date:
29/07/2024
Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before version 4.3.10, there is a Remote Code Execution Vulnerability in the Message module of the Admidio Application, where it is possible to upload a PHP file in the attachment. The uploaded file can be accessed publicly through the URL `{admidio_base_url}/adm_my_files/messages_attachments/{file_name}`. The vulnerability is caused due to the lack of file extension verification, allowing malicious files to be uploaded to the server and public availability of the uploaded file. This vulnerability is fixed in 4.3.10.
Severity CVSS v4.0: Pending analysis
Last modification:
29/07/2024

CVE-2024-6576
Publication date:
29/07/2024
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Privilege Escalation.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.12, from 2023.1.0 before 2023.1.7, from 2024.0.0 before 2024.0.3.
Severity CVSS v4.0: Pending analysis
Last modification:
01/08/2025

CVE-2024-6984
Publication date:
29/07/2024
An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm.
Severity CVSS v4.0: Pending analysis
Last modification:
11/09/2024

CVE-2024-40576
Publication date:
29/07/2024
Cross Site Scripting vulnerability in Best House Rental Management System 1.0 allows a remote attacker to execute arbitrary code via the "House No" and "Description" parameters in the houses page at the index.php component.
Severity CVSS v4.0: Pending analysis
Last modification:
06/05/2025

CVE-2024-41021
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()<br /> <br /> There is no support for HWPOISON, MEMORY_FAILURE, or ARCH_HAS_COPY_MC on<br /> s390. Therefore we do not expect to see VM_FAULT_HWPOISON in<br /> do_exception().<br /> <br /> However, since commit af19487f00f3 ("mm: make PTE_MARKER_SWAPIN_ERROR more<br /> general"), it is possible to see VM_FAULT_HWPOISON in combination with<br /> PTE_MARKER_POISONED, even on architectures that do not support HWPOISON<br /> otherwise. In this case, we will end up on the BUG() in do_exception().<br /> <br /> Fix this by treating VM_FAULT_HWPOISON the same as VM_FAULT_SIGBUS, similar<br /> to x86 when MEMORY_FAILURE is not configured. Also print unexpected fault<br /> flags, for easier debugging.<br /> <br /> Note that VM_FAULT_HWPOISON_LARGE is not expected, because s390 cannot<br /> support swap entries on other levels than PTE level.
Severity CVSS v4.0: Pending analysis
Last modification:
25/09/2025

CVE-2024-41020
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> filelock: Fix fcntl/close race recovery compat path<br /> <br /> When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when<br /> fcntl/close race is detected"), I missed that there are two copies of the<br /> code I was patching: The normal version, and the version for 64-bit offsets<br /> on 32-bit kernels.<br /> Thanks to Greg KH for stumbling over this while doing the stable<br /> backport...<br /> <br /> Apply exactly the same fix to the compat path for 32-bit kernels.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-41022
Publication date:
29/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()<br /> <br /> The "instance" variable needs to be signed for the error handling to work.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025
Subscribe to Vulnerabilities