Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-5476

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFE_TBL_ValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cfe_tbl_passthru_codec.c. The manipulation leads to integer overflow. The complexity of an attack is rather high. The exploitability is told to be difficult. A fix is planned for the upcoming version milestone of the project.

Gravedad CVSS v4.0: BAJA

Última modificación:

07/04/2026

CVE-2026-32186

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

07/04/2026

CVE-2026-0545

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

07/04/2026

CVE-2026-5473

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability has been found in NASA cFS up to 7.0.0. The impacted element is the function pickle.load of the component Pickle Module. Such manipulation leads to deserialization. The attack needs to be performed locally. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: BAJA

Última modificación:

07/04/2026

CVE-2026-5474

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was found in NASA cFS up to 7.0.0. This affects the function CFE_MSG_GetSize of the file apps/to_lab/fsw/src/to_lab_passthru_encode.c of the component CCSDS Packet Header Handler. Performing a manipulation results in heap-based buffer overflow. The attacker must have access to the local network to execute the attack. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: MEDIA

Última modificación:

07/04/2026

CVE-2026-28373

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the filePath property. A malicious export can write arbitrary content to any path on the victim&#39;s filesystem.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

07/04/2026

CVE-2026-5471

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was detected in Investory Toy Planet Trouble App up to 1.5.5 on Android. Impacted is an unknown function of the file assets/google-services-desktop.json of the component app.investory.toyfactory. The manipulation of the argument current_key results in use of hard-coded cryptographic key<br /> . The attack must be initiated from a local position. The exploit is now public and may be used.

Gravedad CVSS v4.0: BAJA

Última modificación:

07/04/2026

CVE-2026-5472

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The affected element is an unknown function of the file /admin_panel/settings.php of the component Profile Picture Handler. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

Gravedad CVSS v4.0: MEDIA

Última modificación:

07/04/2026

CVE-2026-5470

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protocol Handler. The manipulation of the argument URL leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

Gravedad CVSS v4.0: MEDIA

Última modificación:

07/04/2026

CVE-2026-35218

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase&#39;s Builder Command Palette renders entity names (tables, views, queries, automations) using Svelte&#39;s {@html} directive without any sanitization. An authenticated user with Builder access can create a table, automation, view, or query whose name contains an HTML payload (e.g. ). When any Builder-role user in the same workspace opens the Command Palette (Ctrl+K), the payload executes in their browser, stealing their session cookie and enabling full account takeover. This issue has been patched in version 3.32.5.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/04/2026

CVE-2026-35216

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that contains a Bash step via the public webhook endpoint. No authentication is required to trigger the exploit. The process executes as root inside the container. This issue has been patched in version 3.33.4.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

08/04/2026

CVE-2026-35214

Fecha de publicación:

03/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() without sanitizing path traversal sequences. An attacker with Global Builder privileges can craft a multipart upload with a filename containing ../ to delete arbitrary directories via rmSync and write arbitrary files via tarball extraction to any filesystem path the Node.js process can access. This issue has been patched in version 3.33.4.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/04/2026

Suscribirse a Vulnerabilidades