Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-42393

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access to the same network as the doveadm service, able to make repeated requests and measure response timing accurately, can learn the length of the secret, which reduces the effort needed to guess it. The secret value itself is not disclosed. Restrict network access to the doveadm service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: BAJA

Última modificación:

28/08/2026

CVE-2026-42395

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-40013

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve service compiles the script. This causes memory corruption and an observed crash of the ManageSieve process, resulting in denial of service for script management. This might be able to be used for remote code execution. Disable the ManageSieve service if users do not need remote Sieve script management. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-40014

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-27852

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/08/2026

CVE-2026-33263

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the new submission connection gets terminated. If running in high-performance mode (default for Pro releases), all connections handled by the submission-login process will be terminated. The crashes can cause failure for user to send a message, or it can cause duplicate messages to be sent. If TLS is not used (in the backend server processing the submission), duplicate deliveries cannot happen, because the crash can only happen at AUTH stage. Limit the number of connections handled by single submission-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-33604

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from being interpreted as SMTP commands. A downstream mail server that hasn&#39;t yet fixed the SMTP smuggling vulnerability can be tricked into treating part of the message body as new SMTP commands, allowing injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 and CVE-2023-51766. Where you control the receiving mail servers, ensure they reject bare carriage returns in message data. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-33605

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker&#39;s own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/08/2026

CVE-2026-33606

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-33607

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage and kill the offending process and lock account. Alternatively install fixed version. No publicly available exploits are known.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-18393

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond<br /> the bounds of a heap-allocated buffer when processing crafted TDSC cursor<br /> data. A remote attacker could exploit this by supplying a specially crafted<br /> video file, potentially leading to a denial of service or arbitrary code<br /> execution.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-9548

Fecha de publicación:

28/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An improper neutralization of input during web page generation (&#39;Cross-site Scripting&#39;) vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

Suscribirse a Vulnerabilidades