Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2025-36857

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application&#39;s configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom configuration files. These files, which are loaded in alphabetical order, can override or change the settings of the original configuration files, creating a security vulnerability. This issue stems from improper directory access management.<br /> <br /> This vulnerability was remediated in version 7.5.021 of the product.

Gravedad CVSS v3.1: BAJA

Última modificación:

11/12/2025

CVE-2025-36601

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** Dell PowerScale OneFS, versions 9.5.0.0 through 9.11.0.0, contains an exposure of sensitive information to an unauthorized actor vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Information disclosure.

Gravedad CVSS v3.1: MEDIA

Última modificación:

31/10/2025

CVE-2025-10951

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was identified in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this vulnerability is the function log_handler of the file ml_logger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Gravedad CVSS v4.0: MEDIA

Última modificación:

26/09/2025

CVE-2025-27262

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** Ericsson Indoor Connect 8855 contains a command injection vulnerability which if exploited can result in an escalation of privileges.

Gravedad CVSS v4.0: ALTA

Última modificación:

02/10/2025

CVE-2025-10950

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function log_handler of the file ml_logger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Gravedad CVSS v4.0: MEDIA

Última modificación:

26/09/2025

CVE-2025-10949

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Gravedad CVSS v4.0: MEDIA

Última modificación:

26/09/2025

CVE-2025-10541

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** iMonitor EAM 9.6394 installs a system service (eamusbsrv64.exe) that runs with NT AUTHORITY\SYSTEM privileges. This service includes an insecure update mechanism that automatically loads files placed in the C:\sysupdate\ directory during startup. Because any local user can create and write to this directory, an attacker can place malicious DLLs or executables in it. Upon service restart, the files are moved to the application’s installation path and executed with SYSTEM privileges, leading to privilege escalation.

Gravedad CVSS v3.1: ALTA

Última modificación:

03/11/2025

CVE-2025-10542

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** iMonitor EAM 9.6394 ships with default administrative credentials that are also displayed within the management client’s connection dialog. If the administrator does not change these defaults, a remote attacker can authenticate to the EAM server and gain full control over monitored agents and data. This enables reading highly sensitive telemetry (including keylogger output) and issuing arbitrary actions to all connected clients.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

03/11/2025

CVE-2020-36851

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** Rob -- W / cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets (SSRF). Because the proxy forwards requests and headers, an attacker can reach internal-only endpoints and link-local metadata services, retrieve instance role credentials or other sensitive metadata, and interact with internal APIs and services that are not intended to be internet-facing. The vulnerability is exploitable by sending crafted requests to the proxy with the target resource encoded in the URL; many cors-anywhere deployments forward arbitrary methods and headers (including PUT), which can permit exploitation of IMDSv2 workflows as well as access to internal management APIs. Successful exploitation can result in theft of cloud credentials, unauthorized access to internal services, remote code execution or privilege escalation (depending on reachable backends), data exfiltration, and full compromise of cloud resources. Mitigation includes: restricting the proxy to trusted origins or authentication, whitelisting allowed target hosts, preventing access to link-local and internal IP ranges, removing support for unsafe HTTP methods/headers, enabling cloud provider mitigations, and deploying network-level protections.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

26/09/2025

CVE-2025-5494

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup.<br /> <br /> This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13.

Gravedad CVSS v3.1: BAJA

Última modificación:

22/10/2025

CVE-2025-59831

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** git-commiters is a Node.js function module providing committers stats for their git repository. Prior to version 0.1.2, there is a command injection vulnerability in git-commiters. This vulnerability manifests with the library&#39;s primary exported API: gitCommiters(options, callback) which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution. This issue has been patched in version 0.1.2.

Gravedad CVSS v4.0: ALTA

Última modificación:

16/10/2025

CVE-2025-59834

Fecha de publicación:

25/09/2025

Idioma:

Inglés

*** Pendiente de traducción *** ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

14/10/2025

Suscribirse a Vulnerabilidades