Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-4974

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/03/2026

CVE-2026-4971

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/03/2026

CVE-2026-34391

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet&#39;s Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/03/2026

CVE-2026-34475

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/03/2026

CVE-2026-34205

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the local network. On Linux, this configuration does not restrict access to the app as intended, allowing any device on the same network to reach these endpoints without authentication. Home Assistant Supervisor 2026.03.02 addresses the issue.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

30/03/2026

CVE-2026-34388

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet&#39;s gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Version 4.81.0 patches the issue.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/03/2026

CVE-2026-34389

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/03/2026

CVE-2026-33765

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions prior to 6.0 have a critical OS Command Injection vulnerability in the savesettings.php file. The application takes the user-controlled $_POST[&#39;webtheme&#39;] parameter and concatenates it directly into a system command executed via PHP&#39;s exec() function. Since the input is neither sanitized nor validated before being passed to the shell, an attacker can append arbitrary system commands to the intended pihole command. Furthermore, because the command is executed with sudo privileges, the injected commands will run with elevated (likely root) privileges. Version 6.0 patches the issue.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/03/2026

CVE-2026-33872

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Leakage or Information Disclosure due to a race condition in the worker protocol. The lack of request-response correlation creates a "stale response" vulnerability. Because the worker does not verify which request a response belongs to, it may return the next available data in the buffer to an unrelated caller. In high-throughput environments where the library processes sensitive user data (e.g., PII, authentication tokens, or private records), a timeout or high concurrent load can cause Data A (belonging to User A) to be returned to User B. This may lead to unauthorized information disclosure that is difficult to trace, as the application may not throw an error but instead provide "valid-looking" yet entirely incorrect and private data to the wrong session. The issue is fixed in v3.1.4.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/03/2026

CVE-2026-33869

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x branch prior to 4.4.15, an attacker that knows of a quote before it has reached a server can prevent it from being correctly processed on that server. The vulnerability has been patched in Mastodon 4.5.8 and 4.4.15. Mastodon 4.3 and earlier are not affected because they do not support quotes.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/03/2026

CVE-2026-33868

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/03/2026

CVE-2026-33871

Fecha de publicación:

27/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server&#39;s lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/03/2026

Suscribirse a Vulnerabilidades