Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2025-14282

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the socket forwardings requested by the remote client as root, only switching to the logged-in user upon spawning a shell or performing some operations like reading the user&#39;s files. With the recent ability of also using unix domain sockets as the forwarding destination any user able to log in via ssh can connect to any unix socket with the root&#39;s credentials, bypassing both file system restrictions and any SO_PEERCRED / SO_PASSCRED checks performed by the peer.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/02/2026

CVE-2025-70845

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is not properly sanitized or escaped.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/02/2026

CVE-2026-26005

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by specifying an internal network host in the video URL, an SSRF can be triggered, causing GET requests to be sent to internal servers. An attacker can exploit this to scan the internal network. Even a regular (non-privileged) user can carry out the attack.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/02/2026

CVE-2026-26020

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.48, an authenticated user could achieve Remote Code Execution (RCE) on the backend server by embedding a disabled block inside a graph. The BlockInstallationBlock — a development tool capable of writing and importing arbitrary Python code — was marked disabled=True, but graph validation did not enforce this flag. This allowed any authenticated user to bypass the restriction by including the block as a node in a graph, rather than calling the block&#39;s execution endpoint directly (which did enforce the flag). This vulnerability is fixed in 0.6.48.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

13/02/2026

CVE-2026-26011

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** navigation2 is a ROS 2 Navigation Framework and System. In 1.3.11 and earlier, a critical heap out-of-bounds write vulnerability exists in Nav2 AMCL&#39;s particle filter clustering logic. By publishing a single crafted geometry_msgs/PoseWithCovarianceStamped message with extreme covariance values to the /initialpose topic, an unauthenticated attacker on the same ROS 2 DDS domain can trigger a negative index write (set->clusters[-1]) into heap memory preceding the allocated buffer. In Release builds, the sole boundary check (assert) is compiled out, leaving zero runtime protection. This primitive allows controlled corruption of the heap chunk metadata(at least the size of the heap chunk where the set->clusters is in is controllable by the attacker), potentially leading to further exploitation. At minimum, it provides a reliable single-packet denial of service that kills localization and halts all navigation.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

13/02/2026

CVE-2026-0619

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** A reachable infinite loop via an integer wraparound is present in Silicon Labs&#39; Matter SDK which allows an attacker to trigger a denial of service. A hard reset is required to recover the device.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/02/2026

CVE-2026-25996

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/02/2026

CVE-2026-26000

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.9.0, 17.4.6, and 16.10.13, it&#39;s possible using comments to inject CSS that would transform the full wiki in a link area leading to a malicious page. This vulnerability is fixed in 17.9.0, 17.4.6, and 16.10.13.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/02/2026

CVE-2026-25933

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal component of the arduino-app-lab application. The issue stems from insufficient sanitization and validation of input data received from connected hardware devices, specifically in the _info.Serial and _info.Address metadata fields. The problem occurs during device information handling. When a board is connected, the application collects identifying attributes to establish a terminal session. Because strict validation is not enforced for the Serial and Address parameters, an attacker with control over the connected hardware can supply specially crafted strings containing shell metacharacters. The exploitation requires direct physical access to a previously tampered board. When the host system processes these fields, any injected payload is executed with the privileges of the user running arduino-app-lab. This vulnerability is fixed in 0.4.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/02/2026

CVE-2026-25949

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managing STARTTLS requests. An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling, causing connections to remain open indefinitely, leading to a denial of service. This vulnerability is fixed in 3.6.8.

Gravedad CVSS v3.1: ALTA

Última modificación:

13/02/2026

CVE-2026-24894

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the previous request (potentially belonging to a different user) before session_start() is called. This vulnerability is fixed in 1.11.2.

Gravedad CVSS v4.0: ALTA

Última modificación:

13/02/2026

CVE-2026-24895

Fecha de publicación:

12/02/2026

Idioma:

Inglés

*** Pendiente de traducción *** FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies that byte index to the original path. Because strings.ToLower() in Go can increase the byte length of certain UTF-8 characters (e.g., Ⱥ expands when lowercased), the computed index may not align with the correct position in the original string. This results in an incorrect SCRIPT_NAME and SCRIPT_FILENAME, potentially causing FrankenPHP to execute a file other than the one intended by the URI. This vulnerability is fixed in 1.11.2.

Gravedad CVSS v4.0: ALTA

Última modificación:

13/02/2026

Suscribirse a Vulnerabilidades