Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-42304

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. A remote, unauthenticated attacker can exploit this by sending a crafted TCP DNS packet containing deeply chained compression pointers. This flaw bypasses previous loop-prevention logic, causing the single-threaded Twisted reactor to hang while processing millions of recursive lookups, effectively freezing the server. This vulnerability is fixed in 26.4.0rc2.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2025-27850

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlinks is uploaded, the web server follows the supplied links when serving content. No mechanisms to restrict those link targets to a specific area of the filesystem is enabled. This allows an attacker to retrieve arbitrary files from the device.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2025-27851

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

14/05/2026

CVE-2025-27852

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is possible. To initiate an exploit of this vulnerability, the victim must execute two actions: (1) view a specific URL served by the WDU, and (2) click an element on the rendered page.

Gravedad CVSS v3.1: MEDIA

Última modificación:

14/05/2026

CVE-2025-27853

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs authentication with the client within the client&#39;s browser. The WebSockets used to communicate with the WDU server do not enforce any authentication. An attacker may bypass all authentication mechanisms by directly utilizing the remote APIs available on the websocket.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2026-21821

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or manipulation through vulnerable third-party components.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2026-44363

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7, an unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html_to_markdown module accepted arbitrary HTTP(S) URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally, the qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to potential man-in-the-middle interception or response tampering. The issue was fixed by validating URL schemes, blocking local and private address ranges, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification. This vulnerability is fixed in 3.0.7.

Gravedad CVSS v4.0: MEDIA

Última modificación:

14/05/2026

CVE-2026-44364

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and earlier, a Cross-Site Request Forgery vulnerability in the MISP Modules website allowed an attacker to cause an authenticated user to submit unintended requests to the home endpoint. The vulnerability was due to the home blueprint being exempted from CSRF protection. This could allow modification of session query data in the context of the authenticated user. The issue was fixed by enabling CSRF protection for the affected blueprint and hardening query parsing.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

14/05/2026

CVE-2026-42550

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $table argument and the keys of the $data array directly into the query, with no identifier quoting and no validation. When an application forwards user-controlled data shapes to these helpers — a common and documented pattern, e.g. $db->insert(&#39;users&#39;, $request->data->getData()) — an attacker can inject arbitrary SQL by crafting malicious array keys. This vulnerability is fixed in 3.18.1.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2026-42551

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditionally honors the X-HTTP-Method-Override header and the $_REQUEST[&#39;_method&#39;] parameter on any HTTP verb (including safe verbs such as GET), with no opt-in and no whitelist of permitted target methods. A GET request can silently become a DELETE or PUT, enabling CSRF escalation against destructive endpoints, bypass of middleware gated on unsafe verbs, and cache poisoning between CDN and origin. This vulnerability is fixed in 3.18.1.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/05/2026

CVE-2026-44351

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authentication-bypass vulnerability in fast-jwt&#39;s async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application&#39;s key resolver returns an empty string (&#39;&#39;), for example via the common keys[decoded.header.kid] || &#39;&#39; JWKS-style fallback, fast-jwt converts it to a zero-length Buffer, hands it to crypto.createSecretKey, derives allowedAlgorithms = [&#39;HS256&#39;,&#39;HS384&#39;,&#39;HS512&#39;] from it, and then verifies the token&#39;s signature against an empty-key HMAC. The attacker simply computes HMAC-SHA256(key=&#39;&#39;, input=&#39;${header}.${payload}&#39;), which Node accepts without complaint — and the verifier returns the attacker-chosen payload (sub, admin, scopes, etc.) as authentic. This vulnerability is fixed in 6.2.4.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

14/05/2026

CVE-2026-42552

Fecha de publicación:

13/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code, and stack trace (including absolute filesystem paths) directly into the HTTP 500 response, with no debug gating. Production deployments leak internal paths, any secret interpolated into an exception message, and full module structure — giving attackers primitives for chaining other weaknesses (LFI, path traversal). This vulnerability is fixed in 3.18.1.

Gravedad CVSS v3.1: ALTA

Última modificación:

15/05/2026

Suscribirse a Vulnerabilidades