Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-35512

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due to insufficient validation of client-controlled size parameters, allowing an out-of-bounds write via crafted PDUs. Pre-authentication exploitation can crash the process, while post-authentication exploitation may achieve remote code execution. This issue has been fixed in version 0.10.6. If users are unable to immediately update, they should run xrdp as a non-privileged user (default since 0.10.2) to limit the impact of successful exploitation.

Gravedad CVSS v4.0: ALTA

Última modificación:

27/04/2026

CVE-2026-40155

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results. Users are affected if their project uses both the vulnerable versions and the proxy handler /me/* and /my-org/* with DPoP enabled. This issue has been fixed in version 4.18.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

27/04/2026

CVE-2026-40196

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** HomeBox is a home inventory and organization system. Versions prior to 0.25.0 contain a vulnerability where the defaultGroup ID remained permanently assigned to a user after being invited to a group, even after their access to that group was revoked. While the web interface correctly enforced the access revocation and prevented the user from viewing or modifying the group&#39;s contents, the API did not. Because the original group ID persisted as the user&#39;s defaultGroup, and this value was not properly validated when the X-Tenant header was omitted, the user could still perform full CRUD operations on the group&#39;s collections through the API, bypassing the intended access controls. This issue has been fixed in version 0.25.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

24/04/2026

CVE-2026-35402

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypassed using APOC CALL procedures, potentially allowing unauthorized write operations or server-side request forgery. This issue is fixed in version 0.6.0.

Gravedad CVSS v4.0: BAJA

Última modificación:

29/04/2026

CVE-2026-33145

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.

Gravedad CVSS v3.1: MEDIA

Última modificación:

27/04/2026

CVE-2026-33689

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger this flaw by sending a specially crafted sequence of packets during the initial connection phase. This vulnerability results from insufficient validation of input buffer lengths before processing dynamic channel communication. Successful exploitation can lead to a denial-of-service (DoS) condition via a process crash or potential disclosure of sensitive information from the service&#39;s memory space. This issue has been fixed in version 0.10.6.

Gravedad CVSS v4.0: ALTA

Última modificación:

27/04/2026

CVE-2026-33436

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render user-supplied filenames directly into HTML using unsafe methods like innerHTML without sanitization. An attacker can craft a file with a malicious filename containing JavaScript that executes in the uploading user&#39;s browser context, resulting in reflected XSS. The issue affects numerous upload endpoints across the application. The issue has been fixed in version 2.0.0.

Gravedad CVSS v3.1: BAJA

Última modificación:

13/05/2026

CVE-2026-23500

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

01/05/2026

CVE-2026-40461

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.

Gravedad CVSS v3.1: ALTA

Última modificación:

04/05/2026

CVE-2026-40434

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.

Gravedad CVSS v3.1: ALTA

Última modificación:

04/05/2026

CVE-2026-40342

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library&#39;s initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server&#39;s OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

27/04/2026

CVE-2026-35215

Fecha de publicación:

17/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the sdl_desc() function does not validate the length of a decoded SDL descriptor from a slice packet. A zero-length descriptor is later used to calculate the number of slice items, causing a division by zero. An unauthenticated attacker can exploit this by sending a crafted slice packet to crash the server. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Gravedad CVSS v3.1: ALTA

Última modificación:

27/04/2026

Suscribirse a Vulnerabilidades