Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-40572

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their address space without validating against forbidden regions, including critical kernel structures such as the IDT, GDT, TSS, and page tables. A local attacker can exploit this to modify kernel interrupt handlers, resulting in privilege escalation from user mode to kernel context. This issue has been fixed in version 0.24.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

20/04/2026

CVE-2026-35465

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client&#39;s virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5.

Gravedad CVSS v3.1: ALTA

Última modificación:

20/04/2026

CVE-2026-40482

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString() via unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0.

Gravedad CVSS v4.0: ALTA

Última modificación:

20/04/2026

CVE-2026-40483

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input value attributes without escaping via htmlspecialchars(). An authenticated user with Finance permissions can inject HTML attribute-breaking characters and event handlers into the comment field, which are stored in the database and execute in the browser of any user who subsequently opens the pledge record for editing, resulting in stored XSS. This issue has been fixed in version 7.2.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

20/04/2026

CVE-2026-40484

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

20/04/2026

CVE-2026-40485

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

20/04/2026

CVE-2026-40581

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

20/04/2026

CVE-2026-40582

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user&#39;s API key, bypassing the normal authentication flow that enforces account lockout and two-factor authentication checks. An attacker with knowledge of a user&#39;s password can obtain API access even when the account is locked or has 2FA enabled, granting direct access to all protected API endpoints with that user&#39;s privileges. This issue has been fixed in version 7.2.0. Note: this issue had a duplicate, GHSA-472m-p3gf-46xp, which has been closed.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

20/04/2026

CVE-2026-40593

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HTML input value attribute without applying htmlspecialchars(). An administrator can save a username containing HTML attribute-breaking characters and event handlers, which execute in the browser of any administrator who subsequently views that user&#39;s editor page, resulting in stored XSS. This issue has been fixed in version 7.2.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

20/04/2026

CVE-2026-40480

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoint loads and returns person records without performing object-level authorization checks. Although the legacy PersonView.php page enforces canEditPerson() restrictions, the API layer omits this check. Any authenticated user with only EditSelf privileges can enumerate and read other members&#39; records, exposing sensitive PII including names, addresses, phone numbers, and email addresses. This issue has been fixed in version 7.2.0.

Gravedad CVSS v4.0: ALTA

Última modificación:

20/04/2026

CVE-2026-40340

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlibs/ptp2/ptp-pack.c` (lines 530–563). The function validates `len

Gravedad CVSS v3.1: MEDIA

Última modificación:

20/04/2026

CVE-2026-40341

Fecha de publicación:

18/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to crash libgphoto2 when processing input from untrusted USB devices. Commit c385b34af260595dfbb5f9329526be5158985987 contains a patch. No known workarounds are available.

Gravedad CVSS v3.1: BAJA

Última modificación:

20/04/2026

Suscribirse a Vulnerabilidades