Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-6810

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user&#39;s calendars and view user data associated with the calendar.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/04/2026

CVE-2026-5347

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capability checks and nonce verification in the admin_init hook that handles the permalink settings update at line 205-209 of wp-books-gallery.php. The vulnerable code checks only for the presence of the &#39;permalink_structure&#39; POST parameter before updating the &#39;wbg_cpt_slug&#39; option, without verifying that the request comes from an authenticated administrator. This makes it possible for unauthenticated attackers to modify the custom post type slug for the books gallery, which changes the URL structure for all book entries and can break existing links and SEO rankings.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/04/2026

CVE-2026-1949

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of the web service.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

24/04/2026

CVE-2026-6947

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypass vulnerability, allowing unauthenticated adjacent network attackers to bypass login attempt limits to perform brute-force attacks to gain control over the device.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/04/2026

CVE-2026-5488

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, these two endpoints only verify the nonce. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve valid Google Ads access tokens and reset Google Ads integration settings.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/04/2026

CVE-2026-6393

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This is due to a missing capability check in the generate_openai_content_callback() function, which relies solely on a nonce rather than verifying user permissions. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger OpenAI API calls using the site&#39;s configured API key with arbitrary user-controlled prompts, leading to unauthorized consumption of the site owner&#39;s paid AI API quota.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/04/2026

CVE-2026-41430

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting redirects to internal URLs only.

Gravedad CVSS v4.0: BAJA

Última modificación:

24/04/2026

CVE-2026-41485

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the `forEach` mutation handler allows any user with permission to create a `Policy` or `ClusterPolicy` to crash the cluster-wide background controller into a persistent CrashLoopBackOff. The same bug also causes the admission controller to drop connections and block all matching resource operations. The crash loop persists until the policy is deleted. The vulnerability is confined to the legacy engine, and CEL-based policies are unaffected. Versions 1.17.2 and 1.16.4 fix the issue.

Gravedad CVSS v3.1: ALTA

Última modificación:

27/04/2026

CVE-2026-41319

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** MailKit is a cross-platform mail client library built on top of MimeKit. A STARTTLS Response Injection vulnerability in versions prior to 4.16.0 allows a Man-in-the-Middle attacker to inject arbitrary protocol responses across the plaintext-to-TLS trust boundary, enabling SASL authentication mechanism downgrade (e.g., forcing PLAIN instead of SCRAM-SHA-256). The internal read buffer in `SmtpStream`, `ImapStream`, and `Pop3Stream` is not flushed when the underlying stream is replaced with `SslStream` during STARTTLS upgrade, causing pre-TLS attacker-injected data to be processed as trusted post-TLS responses. Version 4.16.0 patches the issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/04/2026

CVE-2026-41323

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno&#39;s apiCall feature in ClusterPolicy automatically attaches the admission controller&#39;s ServiceAccount token to outgoing HTTP requests. The service URL has no validation — it can point anywhere, including attacker-controlled servers. Since the admission controller SA has permissions to patch webhook configurations, a stolen token leads to full cluster compromise. Versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4 patch the issue.

Gravedad CVSS v3.1: ALTA

Última modificación:

27/04/2026

CVE-2026-41318

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, AnythingLLM&#39;s in-chat markdown renderer has an unsafe custom rule for images that interpolates the markdown image&#39;s `alt` text into an HTML `alt="..."` attribute without any HTML encoding. Every call-site in the app wraps `renderMarkdown(...)` with `DOMPurify.sanitize(...)` as defense-in-depth — except the `Chartable` component, which renders chart captions with no sanitization. The chart caption is the natural-language text the LLM emits around a `create-chart` tool call, so any attacker who can influence the LLM&#39;s output — most cheaply via indirect prompt injection in a shared workspace document, or directly if they can create a chart record in a multi-user workspace — can trigger stored DOM-level XSS in every other user&#39;s browser when they open that conversation. AnythingLLM chat history is loaded server-side via `GET /api/workspace/:slug/chats` and rendered directly into the chat UI. Version 1.12.1 contains a patch for this issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

27/04/2026

CVE-2026-41324

Fecha de publicación:

24/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.

Gravedad CVSS v3.1: ALTA

Última modificación:

27/04/2026

Suscribirse a Vulnerabilidades