Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-2737

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/04/2026

CVE-2026-29782

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction. This issue has been patched in version 2.10.2.

Gravedad CVSS v3.1: ALTA

Última modificación:

07/04/2026

CVE-2026-2699

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

21/04/2026

CVE-2026-2701

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

21/04/2026

CVE-2026-28805

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the options[stato] GET parameter. The user-supplied value is read from $superselect[&#39;stato&#39;] and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and any other information stored in the MySQL database. This issue has been patched in version 2.10.2.

Gravedad CVSS v3.1: ALTA

Última modificación:

07/04/2026

CVE-2026-26928

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn&#39;t verify hash or vendor&#39;s digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application. This issue was fixed in version 1.1.0.

Gravedad CVSS v4.0: ALTA

Última modificación:

27/04/2026

CVE-2026-26927

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched. In Szafir SDK Web it is possible to change the URL (HTTP Origin) of the application call location. An unauthenticated attacker can craft a website that is able to launch SzafirHost application with arbitrary arguments via Szafir SDK Web browser addon. No validation will be performed to check whether the address specified in `document_base_url` parameter is in any way related to the actual address of the calling web application. The URL address specified in `document_base_url` parameter is then shown in the application confirmation prompt. When a victim confirms the execution of the application, it will be called in the context of attacker&#39;s website URL and might download additional files and libraries from that website. When victim accepts the application execution for the URL showed in the confirmation prompt with the "remember" option before, the prompt won&#39;t be shown and the application will be called in the context of URL provided by the attacker without any interaction. This issue was fixed in version 0.0.17.4.

Gravedad CVSS v4.0: MEDIA

Última modificación:

27/04/2026

CVE-2026-4636

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned resource. Consequently, the attacker gains unauthorized permissions to victim-owned resources, enabling them to obtain a Requesting Party Token (RPT) and access sensitive information or perform unauthorized actions.

Gravedad CVSS v3.1: ALTA

Última modificación:

16/04/2026

CVE-2026-4634

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

Gravedad CVSS v3.1: ALTA

Última modificación:

16/04/2026

CVE-2026-5328

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the file src/main/java/com/suisung/shopsuite/pt/service/impl/ProductIndexServiceImpl.java of the component ProductItemDao Interface. Executing a manipulation of the argument sidx/sort can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This patch is called 42bcb9463425d1be906c3b290cf29885eb5a2324. A patch should be applied to remediate this issue.

Gravedad CVSS v4.0: BAJA

Última modificación:

29/04/2026

CVE-2026-5330

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was found in SourceCodester/mayuri_k Best Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=delete_user of the component User Delete Handler. Performing a manipulation of the argument ID results in improper access controls. The attack may be initiated remotely. The exploit has been made public and could be used.

Gravedad CVSS v4.0: MEDIA

Última modificación:

29/04/2026

CVE-2026-5331

Fecha de publicación:

02/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in OpenCart 4.1.0.3. This affects an unknown part of the file installer.php of the component Extension Installer Page. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Gravedad CVSS v4.0: BAJA

Última modificación:

29/04/2026

Suscribirse a Vulnerabilidades