Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2025-67903

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/05/2026

CVE-2026-49054

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly Configured Access Control Security Levels.<br /> <br /> This issue affects The Post Grid: from n/a through 7.9.2.

Gravedad CVSS v3.1: MEDIA

Última modificación:

27/05/2026

CVE-2026-48027

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

27/05/2026

CVE-2026-45027

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP&#39;s hash() function with the SHA-256 algorithm and no salt before comparing it to the stored value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is a general-purpose cryptographic hash built for speed, not password storage. Without a salt, identical passwords produce identical digests, making the entire hash database vulnerable to a single precomputed rainbow table lookup. This vulnerability is fixed in 3.7.3.

Gravedad CVSS v3.1: MEDIA

Última modificación:

27/05/2026

CVE-2026-45335

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** WeGIA is a web manager for charitable institutions. Prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=InternoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.7.3.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/05/2026

CVE-2026-44473

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE&#39;s AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE&#39;s logical NG-connection, then creates a GTP tunnel towards that radio. This vulnerability is fixed in 1.10.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

27/05/2026

CVE-2026-44474

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn&#39;t enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0.

Gravedad CVSS v3.1: BAJA

Última modificación:

27/05/2026

CVE-2026-44475

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core&#39;s stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

27/05/2026

CVE-2026-44483

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get (used by @rvf/core to flatten incoming form data into a nested object) does not block the keys __proto__, constructor, or prototype when walking a path. Because field names in submitted form data are passed directly to setPath via preprocessFormData (and through parseFormData / validate), an attacker who can submit a form to a Remix / React Router app using the library can set arbitrary properties on Object.prototype of the running server process. This is a default-reachable prototype pollution primitive: no special configuration is required. Any endpoint that accepts a form via parseFormData or runs a validator created with createValidator is affected. This vulnerability is fixed in 6.0.4 and 7.0.2.

Gravedad CVSS v3.1: ALTA

Última modificación:

27/05/2026

CVE-2026-44330

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can use a forged or arbitrary bearer token (e.g. Authorization: Bearer not-a-real-token) to read PFD application data via GET /applications and GET /applications/{appID}, and to create or delete PFD change-notification subscriptions via POST /subscriptions and DELETE /subscriptions/{subID}. Same root cause as the other NEF SBI findings: the route group is mounted without any inbound auth middleware. Unlike the OAM and traffic-influence groups, nnef-pfdmanagement IS declared in the runtime ServiceList, so this is the production-intended path that operators expect to be protected by OAuth2 setting receive from NRF: true -- and it is not. This vulnerability is fixed in 4.2.2.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

28/05/2026

CVE-2026-44329

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

28/05/2026

CVE-2026-44328

Fecha de publicación:

27/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC&#39;s SMF mounts the UPI management route group without inbound OAuth2 middleware. On top of that, the DELETE /upi/v1/upNodesLinks/{upNodeRef} handler unconditionally dereferences upNode.UPF after the type-guarded async release, even though AN-typed nodes are constructed without a UPF object. As a result, a single unauthenticated DELETE /upi/v1/upNodesLinks/gNB1 request crashes the handler with a nil-pointer panic AND mutates the in-memory user-plane topology before panicking (the UpNodeDelete(upNodeRef) line runs first). This is an unauthenticated, state-mutating panic-DoS sink that an off-path network attacker can trigger by name against any AN entry. This vulnerability is fixed in 4.2.2.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/05/2026

Suscribirse a Vulnerabilidades