Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-104704

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient&#39;s mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/10/2026

CVE-2026-104671

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The TutorStarter WordPress theme before 4.0.4 does not respect the site&#39;s user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/10/2026

CVE-2026-105190

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site&#39;s user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site&#39;s default role.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/10/2026

CVE-2026-103649

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery (denial of service). The server set its socket timeouts in the form Windows takes, which Linux refuses, and its HTTPS clients read without a deadline, so a peer that accepts a connection and then sends nothing held the waiting thread for as long as the connection stayed open. The MTA-STS policy fetch, enabled by default, is made during outbound delivery to mta-sts., so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound delivery stops. The same flaw affects the DANE TLSA query, the OAuth2 token request, the ACME client, and the ManageSieve and metrics listeners, which a silent client stops from serving anyone else. Windows builds are not affected.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/10/2026

CVE-2026-104658

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update&#39;s signature and the systemd unit to stop before reading the service account&#39;s files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update&#39;s path unit is active - the default for the project&#39;s .deb and .rpm packages - and on AppImage installations run under that unit.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/10/2026

CVE-2026-103010

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/10/2026

CVE-2026-103011

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact. In 6.3.4 and 6.3.5, where the self-service REST API is enabled (it is off by default), the user does this remotely by adding a fetch account whose password is 129 to 247 characters long and not a multiple of 8, and then requesting their personal data export (GET /api/v1/me/export.zip), which encrypts that password with the legacy scheme. The same flaw is reachable on Windows by any local interactive user with no hMailServer credentials, through the COM method Utilities.BlowfishEncrypt, which checked no authentication. It is also reachable by every stored-secret write when ProtectStoredSecretsWithDPAPI is set to 0. For such a length, the routine&#39;s padding loop writes up to 7 zero bytes 2 to 232 bytes past the end of its 255-byte heap buffer. The ciphertext it returns is still correct.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/10/2026

CVE-2026-103647

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail&#39;s origin with that user&#39;s session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail&#39;s origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/10/2026

CVE-2026-103517

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/10/2026

CVE-2026-107510

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

08/10/2026

CVE-2026-107503

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim&#39;s access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim&#39;s bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/10/2026

CVE-2026-89191

Fecha de publicación:

08/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Unsanitised input in the "template name" field of SQLView KRIS&#39;s Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/10/2026

Suscribirse a Vulnerabilidades