Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-75900

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An out-of-bounds read vulnerability was found in swtpm&#39;s SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

Gravedad CVSS v3.1: MEDIA

Última modificación:

19/08/2026

CVE-2026-72889

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature_method parameter of the incoming message. signature_method is required on every request, so the algorithm used to check a signature is chosen by whoever sent it, and nothing lets the verifying party pin the method instead. When a message names HMAC-SHA1 or HMAC-SHA256, the key is derived from consumer_secret and token_secret rather than from the key the provider deployed. A provider deployed on RSA-SHA1 holds only the consumer public key, and RFC 5849 does not use consumer_secret for that method, so the required parameter is filled with a placeholder. A client that names HMAC-SHA1 instead has its signature checked against that placeholder, so a guessable one is enough to forge requests for any consumer key and token.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-75589

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two strings differ. The time taken to reject a signature varies with the length of the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA key object rather than by comparing strings. A client that can submit messages and time the replies may recover a valid signature one byte at a time rather than searching the whole signature space. Under PLAINTEXT the value compared against is the signature key itself, so the search recovers consumer_secret and token_secret.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-49424

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux siginfo_t. It did not first zero the stack struct. An unprivileged user may observe 104 bytes of uninitialized kernel stack data, which may contain sensitive information.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-49425

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct. It did not first zero the stack struct. An unprivileged user may observe a small amount of uninitialized kernel stack data, which may contain sensitive information.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-58081

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before writing converted characters. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-58082

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv(3) to convert untrusted input to or from one of the affected encodings may be vulnerable to buffer overflows if it uses one of the affected encoding modules.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-58083

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue&#39;s active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the active list. In addition, the copy routine did not hold the appropriate locks while reading knote state, allowing further races. An unprivileged local user can trigger a use-after-free in the kernel, potentially leading to privilege escalation.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-58084

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer&#39;s clock. For a timer using CLOCK_TAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output buffer was copied to userspace. An unprivileged local user can obtain uninitialized kernel stack memory by creating a POSIX timer with CLOCK_TAI and calling timer_settime(2), potentially disclosing sensitive kernel data.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-58085

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver&#39;s replay window, can inject forged or modified transport data packets into the tunnel. A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-58086

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user&#39;s ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably trace unprivileged processes.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

CVE-2026-58087

Fecha de publicación:

19/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced in the interim, but the sequence number wraps after 0x8000 create/destroy cycles. By rapidly destroying and recreating semaphore sets at the same index, another process can cause the sequence number to wrap, allowing a set with a different number of semaphores to pass validation. The subsequent copy then reads or writes past the end of the allocated buffer. An unprivileged local user can trigger out-of-bounds reads and writes on kernel heap memory, potentially leading to privilege escalation.

Gravedad: Pendiente de análisis

Última modificación:

19/08/2026

Suscribirse a Vulnerabilidades