Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-57853
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template//render/. Attackers can exploit the standard cycler.__init__.__globals__.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user, confirmed as root in default Docker deployments, achieving remote code execution.
Gravedad CVSS v4.0: ALTA
Última modificación:
04/11/2026

CVE-2026-121971
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together with the default scope’s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server. This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.<br /> <br /> <br /> <br /> The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.http_client.scoped_clients.<br /> <br /> To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.
Gravedad CVSS v4.0: ALTA
Última modificación:
04/11/2026

CVE-2026-122054
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang.
Gravedad CVSS v3.1: MEDIA
Última modificación:
04/11/2026

CVE-2026-122116
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.
Gravedad CVSS v3.1: MEDIA
Última modificación:
04/11/2026

CVE-2026-122118
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized network access and intercept Wi-Fi traffic.
Gravedad CVSS v3.1: ALTA
Última modificación:
04/11/2026

CVE-2026-121927
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Gravedad CVSS v4.0: BAJA
Última modificación:
04/11/2026

CVE-2026-76506
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device.<br /> <br /> This vulnerability is due to insufficient validation of user-supplied input in an HTTP request. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected endpoint on an affected device. A successful exploit could allow the attacker to execute arbitrary commands, write arbitrary files to the filesystem, and obtain sensitive information. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.<br /> Cisco has released software updates that address this vulnerability There are no workarounds that address this vulnerability.
Gravedad CVSS v3.1: ALTA
Última modificación:
04/11/2026

CVE-2026-76419
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.<br /> <br /> This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Gravedad CVSS v3.1: MEDIA
Última modificación:
04/11/2026

CVE-2026-121926
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.
Gravedad CVSS v4.0: MEDIA
Última modificación:
04/11/2026

CVE-2026-20241
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate.<br /> <br /> This vulnerability is due to improper authorization checks. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to bypass authorization to obtain an endpoint certificate.
Gravedad CVSS v3.1: MEDIA
Última modificación:
04/11/2026

CVE-2026-119747
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin&amp;#39;s manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users&amp;#39; invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.
Gravedad CVSS v4.0: ALTA
Última modificación:
04/11/2026

CVE-2026-119748
Fecha de publicación:
04/11/2026
Idioma:
Inglés
*** Pendiente de traducción *** The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user&amp;#39;s invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
Gravedad CVSS v4.0: MEDIA
Última modificación:
04/11/2026
Suscribirse a Vulnerabilidades