Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2024-5539
Fecha de publicación:
27/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** The Access Control Bypass vulnerability found in ALC WebCTRL and Carrier i-Vu in versions up to and including 8.5 allows a malicious actor to bypass intended access restrictions and expose sensitive information via the <br /> <br /> web based building automation server.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
27/11/2025

CVE-2024-5540
Fecha de publicación:
27/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels allowing a <br /> <br /> malicious actor to compromise the client browser<br /> <br /> .
Gravedad CVSS v4.0: MEDIA
Última modificación:
27/11/2025

CVE-2025-0657
Fecha de publicación:
27/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver<br /> version drv_gen5_106-01-2380, allows<br /> malformed packets to be sent through BACnet MS/TP network causing the devices to enter a fault state. This fault state requires a manual power cycle to<br /> return the device to network visibility.
Gravedad CVSS v4.0: ALTA
Última modificación:
27/11/2025

CVE-2025-0658
Fecha de publicación:
27/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability in Automated Logic and Carrier&amp;#39;s Zone Controller via BACnet protocol<br /> causes the device to crash. The device enters a fault state; after a reset,<br /> a second packet can leave it permanently unresponsive until a manual power cycle<br /> is performed.
Gravedad CVSS v4.0: ALTA
Última modificación:
27/11/2025

CVE-2025-66040
Fecha de publicación:
27/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user&amp;#39;s browser during OAuth authentication. This issue has been patched in version 2.25.2.
Gravedad CVSS v3.1: BAJA
Última modificación:
27/11/2025

CVE-2025-64344
Fecha de publicación:
26/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Gravedad CVSS v3.1: ALTA
Última modificación:
26/11/2025

CVE-2025-66030
Fecha de publicación:
26/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Gravedad CVSS v4.0: MEDIA
Última modificación:
26/11/2025

CVE-2025-66031
Fecha de publicación:
26/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Gravedad CVSS v4.0: ALTA
Última modificación:
26/11/2025

CVE-2025-66035
Fecha de publicación:
26/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular&amp;#39;s HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Gravedad CVSS v4.0: ALTA
Última modificación:
26/11/2025

CVE-2025-64330
Fecha de publicación:
26/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a single byte read heap overflow when logging the verdict in eve.alert and eve.drop records can lead to crashes. This requires the per packet alert queue to be filled with alerts and then followed by a pass rule. This issue has been patched in versions 7.0.13 and 8.0.2. To reduce the likelihood of this issue occurring, the alert queue size a should be increased (packet-alert-max in suricata.yaml) if verdict is enabled.
Gravedad CVSS v3.1: ALTA
Última modificación:
26/11/2025

CVE-2025-64331
Fecha de publicación:
26/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow can occur on large HTTP file transfers if the user has increased the HTTP response body limit and enabled the logging of printable http bodies. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves using default HTTP response body limits and/or disabling http-body-printable logging; body logging is disabled by default.
Gravedad CVSS v3.1: ALTA
Última modificación:
26/11/2025

CVE-2025-64332
Fecha de publicación:
26/11/2025
Idioma:
Inglés
*** Pendiente de traducción *** Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, a stack overflow that causes Suricata to crash can occur if SWF decompression is enabled. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling SWF decompression (swf-decompression in suricata.yaml), it is disabled by default; set decompress-depth to lower than half your stack size if swf-decompression must be enabled.
Gravedad CVSS v3.1: ALTA
Última modificación:
26/11/2025
Suscribirse a Vulnerabilidades