Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-35068

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command (&#39;SQL Injection&#39;) vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to information disclosure.

Gravedad CVSS v3.1: BAJA

Última modificación:

25/06/2026

CVE-2026-35069

Fecha de publicación:

17/06/2026

Idioma:

Inglés

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-32652

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Dell AIOps Collector versions prior to 1.18.3 contain a "Use of Default Credentials" vulnerability. A low privileged attacker with console access could potentially exploit this vulnerability to gain Filesystem access. This vulnerability only affects fresh installations of Collector versions earlier than 1.18.3. Systems that have been upgraded (either manually or automatically) to version 1.18.3 or later are not impacted, even if they were originally installed on an earlier version.

Gravedad CVSS v3.1: ALTA

Última modificación:

23/06/2026

CVE-2026-20246

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the vmadmin CLI of Cisco Umbrella Virtual Appliance could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied commands. An attacker with vmadmin privileges could exploit this vulnerability by using certain commands at the CLI. A successful exploit could allow the attacker to elevate privileges to root.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/06/2026

CVE-2026-20220

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the web-based management interface of Cisco Crosswork Network Controller could allow an&nbsp;authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to insufficient input validation in the configuration&nbsp;template engine of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system in limited areas of the file system. This vulnerability affects only areas of the operating system for which the template user has write permissions.&nbsp; To exploit this vulnerability, the attacker must have valid template user credentials with write permissions. Template users with read permissions cannot exploit this vulnerability.&nbsp;

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/06/2026

CVE-2026-20190

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

Gravedad CVSS v3.1: ALTA

Última modificación:

22/06/2026

CVE-2026-12515

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Katello&#39;s of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for repositories outside the products they were authorized to manage. An authenticated attacker could exploit this issue to determine whether specific content exists within repositories that should otherwise be inaccessible. This issue does not allow unauthorized modification, import, or publication of content.

Gravedad CVSS v3.1: MEDIA

Última modificación:

26/06/2026

CVE-2026-20181

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. In single-node deployments, successful exploitation of this vulnerability could cause the affected ISE node to become unavailable, resulting in a denial of service (DoS) condition. In that condition, endpoints that have not already authenticated would be unable to access the network until the node is restored.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

22/06/2026

CVE-2026-1288

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/06/2026

CVE-2026-12151

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/07/2026

CVE-2025-26240

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

Gravedad CVSS v3.1: ALTA

Última modificación:

22/06/2026

CVE-2025-32748

Fecha de publicación:

17/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Host Header Injection vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to trigger redirections.

Gravedad CVSS v3.1: MEDIA

Última modificación:

09/07/2026

Suscribirse a Vulnerabilidades