Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-6421

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability has been found in Mobatek MobaXterm Home Edition up to 26.1. This affects an unknown part in the library msimg32.dll. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 26.2 is able to mitigate this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Gravedad CVSS v4.0: MEDIA

Última modificación:

29/04/2026

CVE-2026-35496

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that should not be accessible.

Gravedad CVSS v4.0: MEDIA

Última modificación:

20/04/2026

CVE-2026-34018

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product.

Gravedad CVSS v4.0: MEDIA

Última modificación:

20/04/2026

CVE-2026-21719

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.

Gravedad CVSS v4.0: ALTA

Última modificación:

20/04/2026

CVE-2026-5502

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the &#39;content_parent&#39; parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/04/2026

CVE-2026-6080

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the &#39;date&#39; parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/04/2026

CVE-2026-5807

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators from completing these workflows. This vulnerability, CVE-2026-5807, is fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

27/04/2026

CVE-2026-3330

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the &#39;ip_search&#39;, &#39;startdate&#39;, &#39;enddate&#39;, &#39;username_search&#39;, and &#39;useremail_search&#39; parameters in all versions up to, and including, 1.15.40. This is due to the `WDW_FM_Library::validate_data()` method calling `stripslashes()` on user input (removing WordPress&#39;s `wp_magic_quotes()` protection) and the `FMModelSubmissions_fm::get_labels_parameters()` function directly concatenating user-supplied values into SQL queries without using `$wpdb->prepare()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additionally, the Submissions controller skips nonce verification for the `display` task, which means this vulnerability can be triggered via CSRF by tricking an administrator into clicking a crafted link.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/04/2026

CVE-2026-4853

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This is due to insufficient input validation on the fileName parameter in the file upload handler. The plugin sanitizes the fileName parameter using sanitize_text_field(), which removes HTML tags but does not prevent path traversal sequences like &#39;../&#39;. The unsanitized filename is then directly concatenated in Upload::getFileLocation() without using basename() or validating the resolved path stays within the intended directory. When an invalid file is uploaded, the cleanup logic calls dirname() on the traversed path and passes it to Util::rm(), which recursively deletes the entire resolved directory. This makes it possible for authenticated attackers with administrator-level access to traverse outside the intended upload directory and trigger deletion of critical WordPress directories such as wp-content/plugins, effectively disabling all installed plugins and causing severe site disruption.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/04/2026

CVE-2026-5234

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.3.2. The vulnerability exists because the OsStripeConnectController::create_payment_intent_for_transaction action is registered as a public action (no authentication required) and loads invoices by sequential integer invoice_id without any access_key or ownership verification. This is in contrast to other invoice-related actions (view_by_key, payment_form, summary_before_payment) in OsInvoicesController which properly require a cryptographic UUID access_key. This makes it possible for unauthenticated attackers to enumerate valid invoice IDs via an error message oracle, create unauthorized transaction intent records in the database containing sensitive financial data (invoice_id, order_id, customer_id, charge_amount), and on sites with Stripe Connect configured, the response also leaks Stripe payment_intent_client_secret tokens, transaction_intent_key values, and payment amounts for any invoice.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/04/2026

CVE-2026-5427

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in the kubio_rest_pre_insert_import_assets() function, which is hooked to the rest_pre_insert_{post_type} filter for posts, pages, templates, and template parts. When a post is created or updated via the REST API, Kubio parses block attributes looking for URLs in the &#39;kubio&#39; attribute namespace and automatically imports them via importRemoteFile() without verifying the user has the upload_files capability. This makes it possible for authenticated attackers with Contributor-level access and above to bypass WordPress&#39;s normal media upload restrictions and upload files fetched from external URLs to the media library, creating attachment posts in the database.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/04/2026

CVE-2026-5052

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

Gravedad CVSS v3.1: MEDIA

Última modificación:

27/04/2026

Suscribirse a Vulnerabilidades