Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-39388

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao&#39;s Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request&#39;s presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates.

Gravedad CVSS v4.0: BAJA

Última modificación:

21/04/2026

CVE-2026-39396

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao&#39;s OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim&#39;s configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch.

Gravedad CVSS v3.1: BAJA

Última modificación:

21/04/2026

CVE-2026-39861

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code&#39;s sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection. Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to version 2.1.64 or later.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/04/2026

CVE-2026-39946

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.

Gravedad CVSS v4.0: MEDIA

Última modificación:

21/04/2026

CVE-2026-40264

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenBao is an open source identity-based secrets management system. OpenBao&#39;s namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3.

Gravedad CVSS v4.0: BAJA

Última modificación:

21/04/2026

CVE-2026-39320

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within the WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the `context` parameter of a stream subscription, an attacker can force the server&#39;s Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server&#39;s self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Version 2.25.0 contains a fix.

Gravedad CVSS v3.1: ALTA

Última modificación:

21/04/2026

CVE-2026-39377

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.

Gravedad CVSS v3.1: MEDIA

Última modificación:

21/04/2026

CVE-2026-41302

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to make arbitrary network requests. Attackers can exploit unguarded fetch() calls to access internal resources or interact with external services on behalf of the affected system.

Gravedad CVSS v4.0: MEDIA

Última modificación:

21/04/2026

CVE-2026-41303

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenClaw before 2026.3.28 contains an authorization bypass vulnerability in Discord text approval commands that allows non-approvers to resolve pending exec approvals. Attackers can send Discord text commands to bypass the channels.discord.execApprovals.approvers allowlist and approve pending host execution requests.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/04/2026

CVE-2026-41329

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenClaw before 2026.3.31 contains a sandbox bypass vulnerability allowing attackers to escalate privileges via heartbeat context inheritance and senderIsOwner parameter manipulation. Attackers can exploit improper context validation to bypass sandbox restrictions and achieve unauthorized privilege escalation.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

21/04/2026

CVE-2026-41330

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenClaw before 2026.3.31 contains an environment variable override vulnerability in host exec policy that fails to properly enforce proxy, TLS, Docker, and Git TLS controls. Attackers can bypass security controls by overriding environment variables to circumvent proxy settings, TLS verification, Docker restrictions, and Git TLS enforcement.

Gravedad CVSS v4.0: BAJA

Última modificación:

21/04/2026

CVE-2026-41331

Fecha de publicación:

21/04/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows unauthorized group senders to trigger transcription processing. Attackers can exploit insufficient allowlist enforcement to cause resource or billing consumption by initiating audio preflight operations before authorization checks are applied.

Gravedad CVSS v4.0: MEDIA

Última modificación:

21/04/2026

Suscribirse a Vulnerabilidades