Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-2664
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** An out of bounds read vulnerability in the grpcfuse kernel module present in the Linux VM in Docker Desktop for Windows, Linux and macOS up to version 4.61.0 could allow a local attacker to cause an unspecified impact by writing to /proc/docker entries. The issue has been fixed in Docker Desktop 4.62.0 .
Gravedad CVSS v4.0: MEDIA
Última modificación:
24/02/2026

CVE-2025-27555
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this issue. Users who previously used the CLI to set connections should manually delete entries with those connection sensitive values from the log table. This is similar but not the same issue as CVE-2024-50378
Gravedad: Pendiente de análisis
Última modificación:
24/02/2026

CVE-2024-56373
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context, which they should normally not be able to do, leading to potentially remote code execution in the context of web-server (server-side) as a result of a user viewing historical task information.<br /> <br /> The functionality responsible for that (log template history) has been disabled by default in 2.11.1 and users should upgrade to Airflow 3 if they want to continue to use log template history. They can also manually modify historical log file names if they want to see historical logs that were generated before the last log template change.
Gravedad: Pendiente de análisis
Última modificación:
24/02/2026

CVE-2025-11165
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl.<br /> <br /> By dynamically modifying the Velocity engine’s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections.<br /> <br /> Once these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user).
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
24/02/2026

CVE-2024-1524
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user&amp;#39;s information may be replaced during the account provisioning process in cases where federated users share the same username as local users. <br /> <br /> There will be no impact on your deployment if any of the preconditions mentioned below are not met. Only when all the preconditions mentioned below are fulfilled could a malicious actor associate a targeted local user account with a federated IDP user account that they control.<br /> <br /> The Deployment should have: <br /> -An IDP configured for federated authentication with Silent JIT provisioning enabled.<br /> <br /> The malicious actor should have:<br /> -A fresh valid user account in the federated IDP that has not been used earlier.<br /> -Knowledge of the username of a valid user in the local IDP. <br /> -An account at the federated IDP matching the targeted local username.
Gravedad CVSS v3.1: ALTA
Última modificación:
24/02/2026

CVE-2025-40540
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.<br /> <br /> This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
24/02/2026

CVE-2025-40541
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account.<br /> <br /> This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
24/02/2026

CVE-2026-1229
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.<br /> ECDH and ECDSA signing relying on this curve are not affected.<br /> <br /> The bug was fixed in v1.6.3 https://github.com/cloudflare/circl/releases/tag/v1.6.3 .
Gravedad CVSS v4.0: BAJA
Última modificación:
24/02/2026

CVE-2025-40538
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges.<br /> <br /> This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
24/02/2026

CVE-2025-40539
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.<br /> <br /> This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
24/02/2026

CVE-2026-24314
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.
Gravedad CVSS v3.1: MEDIA
Última modificación:
24/02/2026

CVE-2025-15386
Fecha de publicación:
24/02/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Responsive Lightbox &amp; Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved.
Gravedad: Pendiente de análisis
Última modificación:
24/02/2026
Suscribirse a Vulnerabilidades