Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-34404

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue arises because there is no restriction on the width and height parameters of the generated image. The vulnerability was reproduced using the standard configuration and the default templates. This issue has been patched in version 6.2.5.

Gravedad CVSS v4.0: MEDIA

Última modificación:

09/04/2026

CVE-2026-34400

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

10/04/2026

CVE-2026-34406

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. Prior to version 2.0.1, the edit_user endpoint (POST /api/auth/edituser/) allows Any user who can reach that endpoint and submit crafted permission to escalate their own account (or any other account) to superuser by including "is_superuser": true in the request body. The root cause is that CustomUserSerializer explicitly includes is_superuser in its fields list but omits it from read_only_fields, making it a writable field. The edit_user view performs no additional validation to prevent non-superusers from modifying this field. Once is_superuser is set to true, gaining unrestricted access to all application functionality without requiring re-authentication. This issue has been patched in version 2.0.1.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

10/04/2026

CVE-2026-34405

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in version 6.2.5.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/04/2026

CVE-2026-34401

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related to malicious DTD files where an attacker to craft a malicious XML file that loads a DTD that causes XML Notepad to make outbound HTTP/SMB requests, potentially leaking local file contents or capturing the victim&#39;s NTLM credentials. This issue has been patched in version 2.9.0.21.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/04/2026

CVE-2026-5213

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function cgi_adduser_to_session of the file /cgi-bin/account_mgr.cgi. This manipulation of the argument read_list causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Gravedad CVSS v4.0: ALTA

Última modificación:

02/04/2026

CVE-2026-5212

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the function Webdav_Upload_File of the file /cgi-bin/webdav_mgr.cgi. The manipulation of the argument f_file leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Gravedad CVSS v4.0: ALTA

Última modificación:

02/04/2026

CVE-2026-3470

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption, allowing a remote authenticated attacker as admin user could exploit this issue by providing crafted input that corrupts application database.

Gravedad CVSS v3.1: BAJA

Última modificación:

13/04/2026

CVE-2026-3469

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a remote authenticated attacker as admin user to cause the application to become unresponsive.

Gravedad CVSS v3.1: BAJA

Última modificación:

13/04/2026

CVE-2026-34733

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition !php_sapi_name() === &#39;cli&#39; never evaluates to true due to how PHP resolves operator precedence. The ! (logical NOT) operator binds more tightly than === (strict comparison), causing the expression to always evaluate to false, which means the die() statement never executes. As a result, the script is accessible via HTTP without authentication and will delete files from the server&#39;s temp directory while also disclosing the temp directory contents in its response. At time of publication, there are no publicly available patches.

Gravedad CVSS v3.1: MEDIA

Última modificación:

01/04/2026

CVE-2026-34738

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo&#39;s video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video&#39;s status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

Gravedad CVSS v3.1: MEDIA

Última modificación:

01/04/2026

CVE-2026-34739

Fecha de publicación:

31/03/2026

Idioma:

Inglés

*** Pendiente de traducción *** WWBN AVideo is an open source video platform. In versions 26.0 and prior, the User_Location plugin&#39;s testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars() or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo&#39;s SameSite=None cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session. At time of publication, there are no publicly available patches.

Gravedad CVSS v3.1: MEDIA

Última modificación:

01/04/2026

Suscribirse a Vulnerabilidades