Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-5973

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.py. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.

Gravedad CVSS v4.0: MEDIA

Última modificación:

09/04/2026

CVE-2026-5974

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt/tools/libs/terminal.py. This manipulation causes os command injection. The attack is possible to be carried out remotely. The project was informed of the problem early through a pull request but has not reacted yet.

Gravedad CVSS v4.0: MEDIA

Última modificación:

09/04/2026

CVE-2026-5975

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wanIdx leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.

Gravedad CVSS v4.0: ALTA

Última modificación:

09/04/2026

CVE-2026-5976

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sambaEnabled results in os command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

Gravedad CVSS v4.0: ALTA

Última modificación:

09/04/2026

CVE-2026-5187

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Two potential heap out-of-bounds write locations existed in DecodeObjectId() in wolfcrypt/src/asn.c. First, a bounds check only validates one available slot before writing two OID arc values (out[0] and out[1]), enabling a 2-byte out-of-bounds write when outSz equals 1. Second, multiple callers pass sizeof(decOid) (64 bytes on 64-bit platforms) instead of the element count MAX_OID_SZ (32), causing the function to accept crafted OIDs with 33 or more arcs that write past the end of the allocated buffer.

Gravedad CVSS v4.0: BAJA

Última modificación:

09/04/2026

CVE-2026-5194

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Missing hash/digest size and OID checks allow digests smaller than allowed when verifying ECDSA certificates, or smaller than is appropriate for the relevant key type, to be accepted by signature verification functions. This could lead to reduced security of ECDSA certificate-based authentication if the public CA key used is also known. This affects ECDSA/ECC verification when EdDSA or ML-DSA is also enabled.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

09/04/2026

CVE-2026-5972

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. This issue affects the function Terminal.run_command in the library metagpt/tools/libs/terminal.py. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The identifier of the patch is d04ffc8dc67903e8b327f78ec121df5e190ffc7b. Applying a patch is the recommended action to fix this issue.

Gravedad CVSS v4.0: MEDIA

Última modificación:

09/04/2026

CVE-2026-40077

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system&#39;s ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.

Gravedad CVSS v3.1: BAJA

Última modificación:

09/04/2026

CVE-2026-40087

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain&#39;s f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate could accept templates containing attribute access or indexing expressions and subsequently evaluate those expressions during formatting. Second, f-string validation based on parsed top-level field names did not reject nested replacement fields inside format specifiers. In this pattern, the nested replacement field appears in the format specifier rather than in the top-level field name. As a result, earlier validation based on parsed field names did not reject the template even though Python formatting would still attempt to resolve the nested expression at runtime. This vulnerability is fixed in 0.3.84 and 1.2.28.

Gravedad CVSS v3.1: MEDIA

Última modificación:

09/04/2026

CVE-2026-40088

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to inject arbitrary shell commands through shell metacharacters. This vulnerability is fixed in 4.5.121.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

09/04/2026

CVE-2026-40089

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery (SSRF) vulnerability in its API client (apps/dashboard/lib/api.ts). Installations created using the provided install.sh script (including the one‑liner bash

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

09/04/2026

CVE-2026-4436

Fecha de publicación:

09/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A low-privileged remote attacker can send Modbus packets to manipulate <br /> register values that are inputs to the odorant injection logic such that<br /> too much or too little odorant is injected into a gas line.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/04/2026

Suscribirse a Vulnerabilidades