Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-4090
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/04/2026

CVE-2026-2719
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Private WP suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Exceptions' setting in all versions up to, and including, 0.4.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/04/2026

CVE-2026-3362
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.2. This is due to insufficient input sanitization (no sanitize callback on register_setting) and missing output escaping (no esc_attr() on the echoed value in the input's value attribute). The option value is stored via update_option() and rendered unescaped in an HTML attribute context. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses that page. This is particularly impactful in WordPress multisite installations or when DISALLOW_UNFILTERED_HTML is set, where administrators are not granted the unfiltered_html capability.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/04/2026

CVE-2026-4074
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attributes in all versions up to, and including, 1.0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The quran_live_render() function of quran-live.php receives shortcode attributes and passes them directly through shortcode_atts() and extract() without any sanitization. These values are then passed to Render_Quran_Live::render_verse_quran_live() where they are echoed directly into inline blocks using PHP short tags ( and ) at lines 191, 216, 217, 245, and 246 of Class_QuranLive.php. Since the output occurs inside a JavaScript context within tags, an attacker can break out of the JavaScript string and inject arbitrary script code. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/04/2026

CVE-2026-31432
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix OOB write in QUERY_INFO for compound requests<br /> <br /> When a compound request such as READ + QUERY_INFO(Security) is received,<br /> and the first command (READ) consumes most of the response buffer,<br /> ksmbd could write beyond the allocated buffer while building a security<br /> descriptor.<br /> <br /> The root cause was that smb2_get_info_sec() checked buffer space using<br /> ppntsd_size from xattr, while build_sec_desc() often synthesized a<br /> significantly larger descriptor from POSIX ACLs.<br /> <br /> This patch introduces smb_acl_sec_desc_scratch_len() to accurately<br /> compute the final descriptor size beforehand, performs proper buffer<br /> checking with smb2_calc_max_out_buf_len(), and uses exact-sized<br /> allocation + iov pinning.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/04/2026

CVE-2026-31433
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix potencial OOB in get_file_all_info() for compound requests<br /> <br /> When a compound request consists of QUERY_DIRECTORY + QUERY_INFO<br /> (FILE_ALL_INFORMATION) and the first command consumes nearly the entire<br /> max_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()<br /> with PATH_MAX, causing out-of-bounds write beyond the response buffer.<br /> In get_file_all_info(), there was a missing validation check for<br /> the client-provided OutputBufferLength before copying the filename into<br /> FileName field of the smb2_file_all_info structure.<br /> If the filename length exceeds the available buffer space, it could lead to<br /> potential buffer overflows or memory corruption during smbConvertToUTF16<br /> conversion. This calculating the actual free buffer size using<br /> smb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is<br /> insufficient and updating smbConvertToUTF16 to use the actual filename<br /> length (clamped by PATH_MAX) to ensure a safe copy operation.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/04/2026

CVE-2026-31431
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: algif_aead - Revert to operating out-of-place<br /> <br /> This mostly reverts commit 72548b093ee3 except for the copying of<br /> the associated data.<br /> <br /> There is no benefit in operating in-place in algif_aead since the<br /> source and destination come from different mappings. Get rid of<br /> all the complexity added for in-place operation and just copy the<br /> AD directly.
Gravedad CVSS v3.1: ALTA
Última modificación:
12/05/2026

CVE-2026-1845
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Real Estate Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/04/2026

CVE-2026-2714
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Institute Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &amp;#39;Enquiry Form Title&amp;#39; setting in all versions up to, and including, 5.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/04/2026

CVE-2026-2717
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** The HTTP Headers plugin for WordPress is vulnerable to CRLF Injection in all versions up to, and including, 1.19.2. This is due to insufficient sanitization of custom header name and value fields before writing them to the Apache .htaccess file via `insert_with_markers()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary newline characters and additional Apache directives into the .htaccess configuration file via the &amp;#39;Custom Headers&amp;#39; settings, leading to Apache configuration parse errors and potential site-wide denial of service.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/04/2026

CVE-2026-1379
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** The HTTP Headers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.19.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/04/2026

CVE-2026-6842
Fecha de publicación:
22/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
Gravedad CVSS v3.1: BAJA
Última modificación:
22/04/2026
Suscribirse a Vulnerabilidades