Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-25606
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any<br /> other data that the application itself is able to access<br /> <br /> This issue was fixed in version 9.5.
Gravedad CVSS v4.0: ALTA
Última modificación:
22/05/2026

CVE-2026-25607
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded.<br /> <br /> This issue was fixed in version 9.5.
Gravedad CVSS v4.0: MEDIA
Última modificación:
22/05/2026

CVE-2026-25608
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such as passwords, personal data, or authentication tokens.<br /> <br /> This issue was fixed in version 9.5.
Gravedad CVSS v4.0: BAJA
Última modificación:
22/05/2026

CVE-2026-8684
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce for this action is output in the HTML source of every public page through wp_localize_script (MPHB._data.nonces), so any unauthenticated visitor can obtain a valid nonce and perform the action without any account or prior interaction.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/05/2026

CVE-2026-8692
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Vedrixa Forms – User Registration Form, Signup Form &amp; Drag &amp; Drop Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the structure of any form — adding, removing, or altering fields — by writing attacker-controlled data to the plugin&amp;#39;s FORMS database table. The &amp;#39;ajax-nonce&amp;#39; nonce used by this handler is injected into the public frontend via wp_localize_script(), so any authenticated user who visits a page containing a form shortcode can obtain it without any elevated access.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/05/2026

CVE-2026-9011
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the full item content of non-public Dittys — including drafts, pending, scheduled, and disabled entries — by enumerating integer post IDs against the ditty_init AJAX endpoint. Unlike the non-AJAX init() counterpart, init_ajax() does not verify that the requested Ditty has a &amp;#39;publish&amp;#39; post status before loading and returning its items, allowing content that administrators explicitly withheld from public view to be extracted.
Gravedad CVSS v3.1: ALTA
Última modificación:
22/05/2026

CVE-2026-7615
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3. This is due to missing or incorrect nonce validation on the save_widget_context_settings function. This makes it possible for unauthenticated attackers to modify widget visibility context settings stored in the WordPress options table via a forged POST request to /wp-admin/widgets.php via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/05/2026

CVE-2026-7636
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Slider by Soliloquy – Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 via the map_meta_cap. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract draft slider metadata including unpublished media URLs, captions, and slider configuration authored by administrators or editors.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/05/2026

CVE-2026-7798
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.9.87 via the &amp;#39;SubscribeURL&amp;#39; parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the SES bounce handling key (&amp;#39;_fc_bounce_key&amp;#39;) has never been stored (i.e., the site is in its default/unconfigured state with respect to SES bounce handling) as visiting the bounce configuration page auto-generates and stores a random key that causes the authentication check to evaluate correctly and reject unauthenticated requests.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/05/2026

CVE-2026-8381
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** A broken access<br /> control vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2. Certain backend API endpoints do not<br /> correctly enforce authorization checks, allowing an authenticated user with low<br /> privileges to perform actions and access resources intended only for higher‑privileged roles. An attacker with<br /> low‑privileged credentials may exploit<br /> this to gain unauthorized access to administrative or sensitive functionality.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/05/2026

CVE-2026-8679
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playlist ID via the audioigniter_playlist_id query var or the /audioigniter/playlist/{id}/ rewrite rule and returning playlist track data without performing any authentication, capability, or post_status check — only the post_type is validated. This makes it possible for unauthenticated attackers to view track metadata (titles, artists, audio URLs, buy links, download URLs, and cover images) of any playlist on the site, including those in draft, private, pending, or trash status.
Gravedad CVSS v3.1: ALTA
Última modificación:
22/05/2026

CVE-2026-5072
Fecha de publicación:
22/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** A bitwise shift vulnerability in Zephyr&amp;#39;s PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes. An attacker sends a crafted PTP_MSG_MANAGEMENT message to set an unvalidated negative log_announce_interval value in the port&amp;#39;s data set. When a subsequent PTP_MSG_ANNOUNCE message is processed, port_timer_set_timeout_random computes a timeout as NSEC_PER_SEC &gt;&gt; -log_seconds; if the attacker-supplied value is sufficiently negative (e.g., -127), the shift amount exceeds the 64-bit integer width, triggering undefined behavior in C. This can cause a system crash via a compiler-generated illegal instruction trap on some architectures, or produce an erroneous zero timeout leading to resource starvation loops or other logical errors.
Gravedad: Pendiente de análisis
Última modificación:
22/05/2026
Suscribirse a Vulnerabilidades