Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-44373

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.

Gravedad CVSS v3.1: MEDIA

Última modificación:

14/05/2026

CVE-2026-44418

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function&#39;s default case in EcclesiaCRM&#39;s query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.

Gravedad CVSS v4.0: ALTA

Última modificación:

14/05/2026

CVE-2026-44381

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request parameters and incorporated them into database query ordering clauses without sufficient validation of the requested field name. An attacker with access to the affected endpoints could craft a malicious ordering parameter to manipulate the generated SQL query. Depending on database permissions and query context, this could potentially allow unauthorized access to data, modification of query behavior, or other database-level impact. This vulnerability is fixed in 2.5.37.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

15/05/2026

CVE-2026-44380

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, an improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. This vulnerability is fixed in 2.5.37.

Gravedad CVSS v4.0: ALTA

Última modificación:

15/05/2026

CVE-2026-44379

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, MISP Collections did not enforce RFC 4122 UUID validation on the uuid field. As a result, a user able to create or modify Collection records could submit malformed UUID values, potentially causing integrity issues or unexpected behaviour in code paths that assume Collection UUIDs are valid identifiers. This vulnerability is fixed in 2.5.37.

Gravedad CVSS v4.0: MEDIA

Última modificación:

15/05/2026

CVE-2026-44376

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** CubeCart is an ecommerce software solution. Prior to 6.7.0, an unauthenticated Reflected XSS vulnerability exists in the CubeCart v6.x search feature. Due to a logic flaw in classes/catalogue.class.php, user input is reflected without sanitization only when a search returns exactly one product. This flaw bypasses current filters, allowing an attacker to execute malicious JavaScript in the victim&#39;s browser, leading to session hijacking, site defacement, or phishing. This vulnerability is fixed in 6.7.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

15/05/2026

CVE-2026-44372

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

Gravedad CVSS v4.0: MEDIA

Última modificación:

14/05/2026

CVE-2026-42561

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request rejection or completion. This vulnerability is fixed in 0.0.27.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2026-44368

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_mod function implements multiplication via a binary expansion loop whose execution time depends on the Hamming weight of the second operand (the exponent). An attacker who can measure the time of secret‑sharing operations (e.g., via a remote service) could progressively recover the values of shares, ultimately leading to secret reconstruction. This vulnerability is fixed in 0.2.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

14/05/2026

CVE-2026-42602

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector&#39;s configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension&#39;s Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client&#39;s token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens).

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2026-39358

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints in CubeCart v6.x. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database. This vulnerability is fixed in 6.6.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2026-39428

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** CubeCart is an ecommerce software solution. Prior to 6.6.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in CubeCart v6.x. An attacker with administrative privileges can inject malicious JavaScript payloads into multiple fields during the creation or modification of a product. These payloads are stored in the database and executed whenever a user (customer or another administrator) views the affected product pages, which could lead to session hijacking or unauthorized actions. This vulnerability is fixed in 6.6.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

14/05/2026

Suscribirse a Vulnerabilidades