Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-62144

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.

Gravedad: Pendiente de análisis

Última modificación:

22/07/2026

CVE-2026-62145

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.

Gravedad CVSS v3.1: ALTA

Última modificación:

22/07/2026

CVE-2026-56416

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as &#39;datstart + dname_valid(datstart, ...)&#39; and passes it straight to &#39;query_dname_tolower()&#39; without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause &#39;query_dname_tolower()&#39; to walk label-by-label through stale bytes in the per-worker &#39;env->scratch_buffer&#39;, past the end of that heap allocation if &#39;msg-buffer-size&#39; has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/07/2026

CVE-2026-53910

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment. This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815

Gravedad CVSS v4.0: BAJA

Última modificación:

22/07/2026

CVE-2026-54478

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a &#39;proxy-protocol-port&#39; interface with &#39;answer-cookie: yes&#39;, the RFC 9018 server-cookie SipHash is computed over the proxy&#39;s wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place.

Gravedad CVSS v3.1: BAJA

Última modificación:

22/07/2026

CVE-2026-55708

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the &#39;view_local_data&#39; and &#39;view_local_datas&#39; commands of &#39;unbound-control&#39; create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the control interface omits adding the default-protected zones (e.g., RFC 1918 reverse, AS112 zones, .onion, .localhost). Once the local zone tree exists without the defaults, every query for a default-protected name from a client mapped to that view escapes to the public DNS via the iterator instead of being answered locally, bypassing local policy expectations.

Gravedad CVSS v3.1: BAJA

Última modificación:

22/07/2026

CVE-2026-55717

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when &#39;serve-expired: yes&#39; is set together with a &#39;response-ip: redirect&#39; /&#39;response-ip-data: CNAME &#39; rule (or the RPZ &#39;rpz-cname-override&#39; equivalent), a remote client who controls any delegated domain can crash the daemon. The serve-expired-client-timeout callback runs a two-pass loop to chase the respip-generated CNAME alias; on the second pass it resets &#39;alias_rrset&#39; but not &#39;partial_rep&#39;. Later, this inconsistency leads to a NULL pointer dereference and an eventual crash. A malicious actor can exploit the vulnerability by controlling any zone that replies with an A/AAAA record that falls inside the configured response-ip/rpz subnet. By delaying the answer when the previous record has expired, the vulnerable path of &#39;serve-expired-client-timeout&#39; is taken leading to denial of service via the server crash.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/07/2026

CVE-2026-55973

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when &#39;dns-error-reporting: yes&#39; is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option&#39;s length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are moved onto the tail of the synthetic &#39;_er.&#39; report query name. That query name is later used in the iterator via a subquery to send out the DNS Error Report and when Unbound tries to walk that query name during &#39;find_closest_of_type()&#39;, it strips labels using the query name length rather than stopping at the embedded root, walks one byte past it, and feeds the first garbage byte to &#39;dname_query_hash()&#39; as a label length writing over the stack variable &#39;labuf&#39;. One ordinary upstream response from a delegated zone the attacker controls is sufficient to terminate the daemon.

Gravedad CVSS v3.1: ALTA

Última modificación:

22/07/2026

CVE-2026-55990

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the &#39;dnscrypt:&#39; clause lists more &#39;dnscrypt-provider-cert:&#39; files than there are matching &#39;dnscrypt-secret-key:&#39; files, Unbound fills only the matched prefix and leaves the tail slots at the &#39;0xdb&#39; fill that libsodium&#39;s allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with &#39;0xdb&#39; bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are &#39;0xdb&#39; to &#39;dnscrypt-port&#39; will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support (&#39;--enable-dnscrypt&#39;).

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/07/2026

CVE-2026-55991

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When &#39;ngtcp2_conn_writev_stream()&#39; returns &#39;NGTCP2_ERR_STREAM_DATA_BLOCKED&#39;, Unbound continues to call &#39;ngtcp2_ccerr_set_application_error()&#39; with a &#39;-1&#39; error value. The &#39;int&#39; literal &#39;-1&#39; is implicitly converted to the function&#39;s &#39;uint64_t error_code&#39; parameter as &#39;0xFFFFFFFFFFFFFFFF&#39;. The follow-on &#39;ngtcp2_conn_write_connection_close()&#39; serialises that value as a QUIC variable-length integer; because &#39;2^64-1&#39; exceeds the 62-bit varint ceiling, &#39;ngtcp2_put_uvarintlen()&#39; fails &#39;assert(n

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/07/2026

CVE-2026-50046

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct&#39;s (&#39;serviced_query&#39;) lifetime but also referenced by another struct (&#39;waiting_tcp&#39;). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound&#39;s configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured &#39;#authname&#39; suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/07/2026

CVE-2026-50243

Fecha de publicación:

22/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the &#39;respip&#39; module in front of the validator together with a &#39;response-ip&#39; redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can instead rewrite a BOGUS A/AAAA answer to point to an operator&#39;s configured IP. If the validator finds an expired or otherwise invalid RRSIG on an answer whose A record falls within a &#39;response-ip&#39;/RPZ configuration, the answer is still rewritten and given a hard coded security level of INSECURE. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator&#39;s configured IP. A malicious actor can exploit the possible poisonous effect by spoofing a BOGUS A/AAAA answer that falls inside the operator&#39;s configured subnet rewrites. Such DNSSEC protected answers are then insecurely redirected to the operator&#39;s configured target.

Gravedad CVSS v4.0: MEDIA

Última modificación:

22/07/2026

Suscribirse a Vulnerabilidades