Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-43920

Fecha de publicación:

26/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling was accessible without authentication, which allowed unauthenticated remote users to trigger update patch routines that modify configuration files, execute database schema changes, perform filesystem mutations, and clear caches. The /run-patcher endpoint executes privileged maintenance operations - configuration migrations, database patch execution (including ALTER TABLE, DROP TABLE, UPDATE statements), filesystem deletions and renames, and cache clearing - without requiring administrator authentication, CSRF validation, or CLI context. An unauthenticated remote attacker can trigger these operations by sending a simple HTTP GET request to /run-patcher, which can be abused for denial-of-service attacks. Certain patches (e.g., batch token regeneration for all admin and client accounts in patch 53, and session invalidation) are disruptive even when re-executed against an already-patched instance. Repeated or concurrent requests may also cause inconsistent database state. This issue has been fixed in version 0.8.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

26/06/2026

CVE-2026-13322

Fecha de publicación:

26/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in KubeVirt&#39;s downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with access to a VM guest that has the downward metrics virtio-serial device configured can write a continuous byte stream to the device, causing unbounded memory allocation in the virt-handler process until it is OOM-killed.

Gravedad CVSS v3.1: BAJA

Última modificación:

06/07/2026

CVE-2026-13318

Fecha de publicación:

26/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A server-side request forgery (SSRF) flaw was found in KubeVirt&#39;s virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that reports an arbitrary IP address, then request port-forward to establish a bidirectional TCP tunnel from virt-api&#39;s cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation.

Gravedad CVSS v3.1: MEDIA

Última modificación:

06/07/2026

CVE-2026-13218

Fecha de publicación:

26/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in KubeVirt&#39;s virt-handler network cache handling. The WriteToCachedFile function writes data to a launcher-rooted path using os.WriteFile and os.Chown without symlink protection. A user with access to the virt-launcher container can plant a symlink at the cache file path, causing virt-handler to follow it and overwrite an arbitrary host file with JSON content and change its ownership.

Gravedad CVSS v3.1: MEDIA

Última modificación:

06/07/2026

CVE-2026-12993

Fecha de publicación:

26/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.

Gravedad CVSS v3.1: MEDIA

Última modificación:

06/07/2026

CVE-2026-13083

Fecha de publicación:

26/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/07/2026

CVE-2026-40941

Fecha de publicación:

25/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31.

Gravedad CVSS v4.0: ALTA

Última modificación:

29/06/2026

CVE-2026-40084

Fecha de publicación:

25/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal through the Report format_file Parameter, causing arbitrary file read. This vulnerability occurs in two stages. In the first stage (stored injection), lib/html_reports.php at line 283 stores $save[&#39;format_file&#39;] = $post[&#39;format_file&#39;] directly into the database without any validation. In the second stage (file read), lib/reports.php at line 667 concatenates CACTI_PATH_FORMATS . &#39;/&#39; . $format_file, and line 670 then calls file($format_file), reading arbitrary files from the filesystem. This issue has been fixed in version 1.2.31.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/06/2026

CVE-2026-40082

Fecha de publicación:

25/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Session Fixation. session_regenerate_id() is NOT called after successful login. The login flow at auth_login.php:203-207 directly sets $_SESSION[SESS_USER_ID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/06/2026

CVE-2026-40080

Fecha de publicación:

25/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Open Redirect through a substring check rather than a host check at str_contains($referer, CACTI_PATH_URL). When the user&#39;s login_opts == &#39;1&#39; (redirect to referer after login), the function used $_SERVER[&#39;HTTP_REFERER&#39;] directly. An attacker could craft a referer such as https://evil.com/cacti/. Where CACTI_PATH_URL is /cacti/, the substring matches and the user is redirected to evil.com after login. The pre-existing validate_redirect_url() helper at lib/html_utility.php performed proper validation but was not invoked from auth_login_redirect(). This issue has been fixed in version 1.2.31.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/06/2026

CVE-2026-40083

Fecha de publicación:

25/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items by calling cacti_unserialize(stripslashes(gnrv(&#39;selected_graphs_array&#39;))). The cacti_unserialize() function calls unserialize() with allowed_classes set to false, which prevents object injection but still allows arbitrary string arrays to be deserialized. Then, at lines 760 to 766, the deserialized array values are passed directly into db_execute(&#39;DELETE FROM snmpagent_managers WHERE id IN (&#39; . implode(&#39;,&#39;, $selected_items) . &#39;)&#39;), where they are imploded into the SQL statement without any integer validation, resulting in SQL Injection when using SNMP agent management permissions. This issue has been fixed in version 1.2.31.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/06/2026

CVE-2026-8720

Fecha de publicación:

25/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authenticated. This bug is specific to the HMAC-BLAKE2 APIs that were added in wolfSSL version 5.9.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

27/06/2026

Suscribirse a Vulnerabilidades