Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-6980
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo_path of the file main.py. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Gravedad CVSS v4.0: MEDIA
Última modificación:
25/04/2026

CVE-2026-6978
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Gravedad CVSS v4.0: MEDIA
Última modificación:
25/04/2026

CVE-2026-6979
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** A flaw has been found in devlikeapro WAHA up to 2026.3.4. This affects an unknown function of the file src/api/media.controller.ts of the component API Request Handler. This manipulation causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Gravedad CVSS v4.0: MEDIA
Última modificación:
25/04/2026

CVE-2026-6977
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Gravedad CVSS v4.0: MEDIA
Última modificación:
25/04/2026

CVE-2026-31683
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: avoid OGM aggregation when skb tailroom is insufficient<br /> <br /> When OGM aggregation state is toggled at runtime, an existing forwarded<br /> packet may have been allocated with only packet_len bytes, while a later<br /> packet can still be selected for aggregation. Appending in this case can<br /> hit skb_put overflow conditions.<br /> <br /> Reject aggregation when the target skb tailroom cannot accommodate the new<br /> packet. The caller then falls back to creating a new forward packet<br /> instead of appending.
Gravedad: Pendiente de análisis
Última modificación:
25/04/2026

CVE-2026-31684
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: sched: act_csum: validate nested VLAN headers<br /> <br /> tcf_csum_act() walks nested VLAN headers directly from skb-&gt;data when an<br /> skb still carries in-payload VLAN tags. The current code reads<br /> vlan-&gt;h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without<br /> first ensuring that the full VLAN header is present in the linear area.<br /> <br /> If only part of an inner VLAN header is linearized, accessing<br /> h_vlan_encapsulated_proto reads past the linear area, and the following<br /> skb_pull(VLAN_HLEN) may violate skb invariants.<br /> <br /> Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and<br /> pulling each nested VLAN header. If the header still is not fully<br /> available, drop the packet through the existing error path.
Gravedad: Pendiente de análisis
Última modificación:
25/04/2026

CVE-2026-31685
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: ip6t_eui64: reject invalid MAC header for all packets<br /> <br /> `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address<br /> and compares it with the low 64 bits of the IPv6 source address.<br /> <br /> The existing guard only rejects an invalid MAC header when<br /> `par-&gt;fragoff != 0`. For packets with `par-&gt;fragoff == 0`, `eui64_mt6()`<br /> can still reach `eth_hdr(skb)` even when the MAC header is not valid.<br /> <br /> Fix this by removing the `par-&gt;fragoff != 0` condition so that packets<br /> with an invalid MAC header are rejected before accessing `eth_hdr(skb)`.
Gravedad: Pendiente de análisis
Última modificación:
25/04/2026

CVE-2026-31675
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: sch_netem: fix out-of-bounds access in packet corruption<br /> <br /> In netem_enqueue(), the packet corruption logic uses<br /> get_random_u32_below(skb_headlen(skb)) to select an index for<br /> modifying skb-&gt;data. When an AF_PACKET TX_RING sends fully non-linear<br /> packets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.<br /> <br /> Passing 0 to get_random_u32_below() takes the variable-ceil slow path<br /> which returns an unconstrained 32-bit random integer. Using this<br /> unconstrained value as an offset into skb-&gt;data results in an<br /> out-of-bounds memory access.<br /> <br /> Fix this by verifying skb_headlen(skb) is non-zero before attempting<br /> to corrupt the linear data area. Fully non-linear packets will silently<br /> bypass the corruption logic.
Gravedad: Pendiente de análisis
Última modificación:
25/04/2026

CVE-2026-31676
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rxrpc: only handle RESPONSE during service challenge<br /> <br /> Only process RESPONSE packets while the service connection is still in<br /> RXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before<br /> running response verification and security initialization, then use a local<br /> secured flag to decide whether to queue the secured-connection work after<br /> the state transition. This keeps duplicate or late RESPONSE packets from<br /> re-running the setup path and removes the unlocked post-transition state<br /> test.
Gravedad: Pendiente de análisis
Última modificación:
25/04/2026

CVE-2026-31677
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: af_alg - limit RX SG extraction by receive buffer budget<br /> <br /> Make af_alg_get_rsgl() limit each RX scatterlist extraction to the<br /> remaining receive buffer budget.<br /> <br /> af_alg_get_rsgl() currently uses af_alg_readable() only as a gate<br /> before extracting data into the RX scatterlist. Limit each extraction<br /> to the remaining af_alg_rcvbuf(sk) budget so that receive-side<br /> accounting matches the amount of data attached to the request.<br /> <br /> If skcipher cannot obtain enough RX space for at least one chunk while<br /> more data remains to be processed, reject the recvmsg call instead of<br /> rounding the request length down to zero.
Gravedad: Pendiente de análisis
Última modificación:
25/04/2026

CVE-2026-31678
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> openvswitch: defer tunnel netdev_put to RCU release<br /> <br /> ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already<br /> detached the device. Dropping the netdev reference in destroy can race<br /> with concurrent readers that still observe vport-&gt;dev.<br /> <br /> Do not release vport-&gt;dev in ovs_netdev_tunnel_destroy(). Instead, let<br /> vport_netdev_free() drop the reference from the RCU callback, matching<br /> the non-tunnel destroy path and avoiding additional synchronization<br /> under RTNL.
Gravedad: Pendiente de análisis
Última modificación:
25/04/2026

CVE-2026-31679
Fecha de publicación:
25/04/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> openvswitch: validate MPLS set/set_masked payload length<br /> <br /> validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for<br /> SET/SET_MASKED actions. In action handling, OVS expects fixed-size<br /> MPLS key data (struct ovs_key_mpls).<br /> <br /> Use the already normalized key_len (masked case included) and reject<br /> non-matching MPLS action key sizes.<br /> <br /> Reject invalid MPLS action payload lengths early.
Gravedad: Pendiente de análisis
Última modificación:
25/04/2026
Suscribirse a Vulnerabilidades