Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-5355

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability has been found in Trendnet TEW-657BRM 1.00.1. Affected by this issue is the function vpn_drop of the file /setup.cgi. The manipulation of the argument policy_name leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website&#39;s product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.

Gravedad CVSS v4.0: BAJA

Última modificación:

29/04/2026

CVE-2026-5360

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability has been found in Free5GC 4.2.0. The affected element is an unknown function of the component aper. Such manipulation leads to type confusion. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 26205eb01705754b7b902ad6c4b613c96c881e29. It is best practice to apply a patch to resolve this issue.

Gravedad CVSS v4.0: BAJA

Última modificación:

29/04/2026

CVE-2026-5352

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security vulnerability has been detected in Trendnet TEW-657BRM 1.00.1. This impacts the function Edit of the file /setup.cgi. Such manipulation of the argument pcdb_list leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor confirms, that "[t]he product in question (...) has been discontinued and end of life since June 23, 2011, that is more than 14 years ago. We no longer provide support for this product, so we are not able to confirm the vulnerabilities. We will make an announcement on our website&#39;s product support page and notify customers who registered their products with us." This vulnerability only affects products that are no longer supported by the maintainer.

Gravedad CVSS v4.0: BAJA

Última modificación:

29/04/2026

CVE-2026-35385

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users&#39; expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).

Gravedad CVSS v3.1: ALTA

Última modificación:

27/04/2026

CVE-2026-35386

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is untrusted, and also requires a non-default configurations of % in ssh_config.

Gravedad CVSS v3.1: BAJA

Última modificación:

27/04/2026

CVE-2026-35387

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted to mean all ECDSA algorithms.

Gravedad CVSS v3.1: BAJA

Última modificación:

27/04/2026

CVE-2026-35388

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

Gravedad CVSS v3.1: BAJA

Última modificación:

27/04/2026

CVE-2026-35038

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0, there is an arbitrary prototype read vulnerability via `from` field bypass. This vulnerability allows a low-privileged authenticated user to bypass prototype boundary filtering to extract internal functions and properties from the global prototype object this violates data isolation and lets a user read more than they should. This issue has been patched in version 2.24.0.

Gravedad CVSS v4.0: BAJA

Última modificación:

29/04/2026

CVE-2026-34877

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

06/04/2026

CVE-2026-34831

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the number of bytes actually sent on the wire. Because Rack::Files reflects the requested path in 404 responses, an attacker can trigger this mismatch by requesting a non-existent path containing percent-encoded UTF-8 characters. This results in incorrect HTTP response framing and may cause response desynchronization in deployments that rely on the incorrect Content-Length value. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Gravedad CVSS v3.1: MEDIA

Última modificación:

16/04/2026

CVE-2026-34830

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Gravedad CVSS v3.1: MEDIA

Última modificación:

16/04/2026

CVE-2026-34829

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Gravedad CVSS v3.1: ALTA

Última modificación:

16/04/2026

Suscribirse a Vulnerabilidades