Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-20219

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker to access the social profile data of other users or affect quiz and poll results. Cisco has addressed this vulnerability in Cisco Slido and no customer action is needed. This vulnerability existed because of the presence of an insecure direct object reference. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by sending a crafted request to the vulnerable API endpoint. A successful exploit could have allowed the attacker to view the social profiles of other users or affect quiz and poll results.

Gravedad CVSS v3.1: MEDIA

Última modificación:

06/05/2026

CVE-2026-21661

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

Gravedad CVSS v4.0: ALTA

Última modificación:

06/05/2026

CVE-2026-20034

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device.&nbsp;To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

Gravedad CVSS v3.1: ALTA

Última modificación:

06/05/2026

CVE-2026-20035

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.

Gravedad CVSS v3.1: ALTA

Última modificación:

06/05/2026

CVE-2026-20167

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to cause a DoS condition on a remotely managed router. This vulnerability is due to improper error handling. An attacker could exploit this vulnerability by submitting crafted input to the web-based management interface. A successful exploit could allow the attacker to request unauthorized files from a remote router, causing the router to reload and resulting in a DoS condition.

Gravedad CVSS v3.1: ALTA

Última modificación:

06/05/2026

CVE-2026-20168

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to retrieve files that they do not have permission to access. This vulnerability is due to insufficient file access checks. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to read files that they are not authorized to access.

Gravedad CVSS v3.1: MEDIA

Última modificación:

06/05/2026

CVE-2026-20169

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco IoT Field Network Director could allow an authenticated, remote attacker with low privileges to access files and execute commands on a remote router. This vulnerability is due to insufficient input validation of user-supplied data. An attacker could exploit this vulnerability by submitting crafted input in the web-based management interface. A successful exploit could allow the attacker to create, read, or delete files and execute limited commands in&nbsp;user EXEC mode on a remote router.

Gravedad CVSS v3.1: MEDIA

Última modificación:

06/05/2026

CVE-2026-20172

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Agent. This vulnerability is due to inadequate validation of file contents during file upload operations. An attacker could exploit this vulnerability by uploading a file that contains malicious scripts or HTML code, which the application could make available to other users to access. A successful exploit could allow the attacker to execute the contents of that file in the browser of a user and conduct browser-based attacks.&nbsp;

Gravedad CVSS v3.1: MEDIA

Última modificación:

06/05/2026

CVE-2026-6863

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org. However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.

Gravedad CVSS v3.1: MEDIA

Última modificación:

06/05/2026

CVE-2026-6691

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** The MongoDB C Driver&#39;s Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI.

Gravedad CVSS v4.0: ALTA

Última modificación:

06/05/2026

CVE-2026-6787

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Use of Hard-coded Cryptographic Key vulnerability in WatchGuard Agent on Windows allows Inclusion of Code in Existing Process.This issue affects WatchGuard Agent: before 1.25.03.0000.

Gravedad CVSS v4.0: ALTA

Última modificación:

06/05/2026

CVE-2026-6788

Fecha de publicación:

06/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Uncontrolled Search Path Element vulnerability in WatchGuard Agent on Windows allows Using Malicious Files.This issue affects WatchGuard Agent before 1.25.03.0000.

Gravedad CVSS v4.0: ALTA

Última modificación:

06/05/2026

Suscribirse a Vulnerabilidades