Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-27588

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy&#39;s HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/02/2026

CVE-2026-27589

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (default listen `127.0.0.1:2019`) exposes a state-changing `POST /load` endpoint that replaces the entire running configuration. When origin enforcement is not enabled (`enforce_origin` not configured), the admin endpoint accepts cross-origin requests (e.g., from attacker-controlled web content in a victim browser) and applies an attacker-supplied JSON config. This can change the admin listener settings and alter HTTP server behavior without user intent. Version 2.11.1 contains a fix for the issue.

Gravedad CVSS v4.0: MEDIA

Última modificación:

24/02/2026

CVE-2026-27590

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy&#39;s FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. This is unsafe for Unicode because `strings.ToLower()` can change UTF-8 byte length for some characters. As a result, Caddy can derive an incorrect `SCRIPT_NAME`/`SCRIPT_FILENAME` and `PATH_INFO`, potentially causing a request that contains `.php` to execute a different on-disk file than intended (path confusion). In setups where an attacker can control file contents (e.g., upload features), this can lead to unintended PHP execution of non-.php files (potential RCE depending on deployment). Version 2.11.1 fixes the issue.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/02/2026

CVE-2026-27571

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. Prior to versions 2.11.2 and 2.12.3, the implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which might then fail validation for size reasons. An attacker can use a compression bomb to cause excessive memory consumption, often resulting in the operating system terminating the server process. The use of compression is negotiated before authentication, so this does not require valid NATS credentials to exploit. The fix, present in versions 2.11.2 and 2.12.3, was to bounds the decompression to fail once the message was too large, instead of continuing on. The vulnerability only affects deployments which use WebSockets and which expose the network port to untrusted end-points.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/02/2026

CVE-2026-27585

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher doesn&#39;t sanitize backslashes which can lead to bypassing path related security protections. It affects users with specific Caddy and environment configurations. Version 2.11.1 fixes the issue.

Gravedad CVSS v4.0: MEDIA

Última modificación:

24/02/2026

CVE-2026-27586

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/02/2026

CVE-2026-27587

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy&#39;s HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request&#39;s escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/02/2026

CVE-2025-13776

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A malicious attacker in local network who knows default credentials is able to read and edit database content.<br /> <br /> This vulnerability has been fixed in version: Finka-FK 18.5, Finka-KPR 16.6, Finka-Płace 13.4, Finka-Faktura 18.3, Finka-Magazyn 8.3, Finka-STW 12.3

Gravedad CVSS v4.0: ALTA

Última modificación:

24/02/2026

CVE-2024-48928

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. However, RAND() only has 30 bits of randomness, making it feasible to brute-force the secret key. The CSRF token is constructed partially from the secret key, and this can be used to check if the brute force succeeded. Trying all possible values takes approximately one hour. The impact of this is limited. The auto login key uses the user&#39;s password on top of the secret key. The pwg token uses the user&#39;s session identifier on top of the secret key. It seems that values for get_ephemeral_key can be generated when one knows the secret key. Version 15.0.0 contains a fix for the issue.

Gravedad CVSS v4.0: BAJA

Última modificación:

24/02/2026

CVE-2026-27521

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or account lockout on failed login attempts, enabling brute-force attacks against user credentials.

Gravedad CVSS v4.0: MEDIA

Última modificación:

24/02/2026

CVE-2026-27516

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext within the administrative interface and HTTP responses, allowing recovery of valid credentials.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/02/2026

CVE-2026-27517

Fecha de publicación:

24/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior reflect unsanitized user input in the web interface, allowing an attacker to inject and execute arbitrary JavaScript in the context of an authenticated user.

Gravedad CVSS v4.0: MEDIA

Última modificación:

24/02/2026

Suscribirse a Vulnerabilidades