Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-43989

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

Gravedad CVSS v3.1: ALTA

Última modificación:

13/05/2026

CVE-2026-25431

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security Levels.<br /> <br /> This issue affects Hustle: through 7.8.10.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/05/2026

CVE-2026-43990

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell&#39;s run_command wrapped every agent-supplied command in &#39;sh -c&#39; / &#39;cmd /C&#39; and passed the full argument string to the shell&#39;s parser, allowing shell metacharacters in agent-supplied arguments to be interpreted as command syntax. This vulnerability is fixed in 0.x.y-security-1.

Gravedad CVSS v3.1: ALTA

Última modificación:

13/05/2026

CVE-2026-40300

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "moves", /api/v1/messages/{id}/history still returns historical content values, allowing low-privilege users to recover text that was edited away from other users&#39; messages. This vulnerability is fixed in 12.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/05/2026

CVE-2026-20881

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Divide by zero for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/05/2026

CVE-2026-20905

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/05/2026

CVE-2026-20914

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 2.6.0 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/05/2026

CVE-2026-20794

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Buffer overflow for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

13/05/2026

CVE-2026-20879

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.

Gravedad CVSS v4.0: ALTA

Última modificación:

13/05/2026

CVE-2026-20887

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Gravedad CVSS v4.0: ALTA

Última modificación:

13/05/2026

CVE-2026-20771

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/05/2026

CVE-2026-20782

Fecha de publicación:

12/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Buffer overflow for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/05/2026

Suscribirse a Vulnerabilidades