Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2021-22194
Publication date:
26/03/2021
In all versions of GitLab, marshalled session keys were being stored in Redis.
Severity CVSS v4.0: Pending analysis
Last modification:
14/09/2021

CVE-2021-22180
Publication date:
26/03/2021
An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.
Severity CVSS v4.0: Pending analysis
Last modification:
12/07/2022

CVE-2021-22184
Publication date:
26/03/2021
An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't properly redacted.
Severity CVSS v4.0: Pending analysis
Last modification:
12/07/2022

CVE-2021-21332
Publication date:
26/03/2021
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains. This is fixed in version 1.27.0.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-21333
Publication date:
26/03/2021
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email. The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker. This is fixed in version 1.27.0.
Severity CVSS v4.0: Pending analysis
Last modification:
07/11/2023

CVE-2021-25371
Publication date:
26/03/2021
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2025

CVE-2021-25369
Publication date:
26/03/2021
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace.
Severity CVSS v4.0: Pending analysis
Last modification:
30/10/2025

CVE-2021-25370
Publication date:
26/03/2021
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic.
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2026

CVE-2021-25372
Publication date:
26/03/2021
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
Severity CVSS v4.0: Pending analysis
Last modification:
14/01/2026

CVE-2021-22886
Publication date:
26/03/2021
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
Severity CVSS v4.0: Pending analysis
Last modification:
30/03/2021

CVE-2021-29255
Publication date:
26/03/2021
MicroSeven MYM71080i-B 2.0.5 through 2.0.20 devices send admin credentials in cleartext to pnp.microseven.com TCP port 7007. An attacker on the same network as the device can capture these credentials.
Severity CVSS v4.0: Pending analysis
Last modification:
02/04/2021

CVE-2021-21403
Publication date:
26/03/2021
In github.com/kongchuanhujiao/server before version 1.3.21 there is an authentication Bypass by Primary Weakness vulnerability. All users are impacted. This is fixed in version 1.3.21.
Severity CVSS v4.0: Pending analysis
Last modification:
24/10/2022
Subscribe to Vulnerabilities