Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-49440

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(candidate[, options][, callback]) and crypto.checkPrimeSync(candidate[, options]) ran no Miller-Rabin rounds at all when the caller left options.checks at its default of 0. In that mode, the only test applied to the candidate was trial division by the primes up to 17,863. Any composite whose smallest prime factor exceeds that bound — for example the product of two primes just above it, such as 17,881 × 17,891 — was reported as true ("probably prime"). The same divergence affected the lower-level op_node_check_prime / op_node_check_prime_bytes paths that the polyfill calls into. This vulnerability is fixed in 2.8.1.

Gravedad CVSS v3.1: ALTA

Última modificación:

26/06/2026

CVE-2026-49406

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYONM mode (nodeModulesDir: "manual"), the module resolver did not validate that a package&#39;s resolved entrypoint stayed within its node_modules// directory. A malicious package.json whose main field contained .. segments was able to resolve to an arbitrary path on disk, and the resolver then read that file without consulting the --allow-read allowlist. This let a require("evil-pkg") call return the contents of a file that a direct Deno.readTextFileSync(...) call would have been blocked from reading. This vulnerability is fixed in 2.7.12.

Gravedad CVSS v3.1: MEDIA

Última modificación:

26/06/2026

CVE-2026-49402

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno&#39;s node:child_process implementation provided an escapeShellArg() helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters and did not neutralize % (which cmd.exe expands even inside double-quoted strings). An attacker who controlled any portion of an argument passed to such a call could inject arbitrary additional commands into the spawned cmd.exe invocation. This vulnerability is fixed in 2.7.10.

Gravedad CVSS v3.1: ALTA

Última modificación:

26/06/2026

CVE-2026-49401

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno&#39;s permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as the same file. That means a program could reach a denied path by spelling it differently than the deny rule. This vulnerability is fixed in 2.7.14.

Gravedad CVSS v3.1: ALTA

Última modificación:

26/06/2026

CVE-2026-45692

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different config object during traversal. This happens because the authorization layer uses string prefix matching and the /config traversal layer parses array indices numerically using strconv.Atoi(). This vulnerability is fixed in 2.11.3.

Gravedad CVSS v3.1: MEDIA

Última modificación:

26/06/2026

CVE-2026-45135

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport&#39;s splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy&#39;s FastCGI splitting into treating a non-.php (or other configured split_path extension) file as a script. In any deployment where the attacker can place content into a file served via FastCGI (uploads, file storage, etc.), this can be escalated to remote code execution by crafting a URL whose path triggers either flaw. This vulnerability is fixed in 2.11.3.

Gravedad CVSS v3.1: ALTA

Última modificación:

26/06/2026

CVE-2026-44726

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno&#39;s Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When `autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook that was bound to the original, failed handle. As a result, the replacement TCP connection was never upgraded to TLS, and any data the application wrote before the secureConnect event travelled over the network unencrypted. A network attacker positioned to cause the initial connection attempt to fail (for example, by dropping IPv6 traffic on a dual-stack host) could deterministically trigger the fallback path and observe or tamper with traffic that the application believed was TLS-protected. This vulnerability is fixed in 2.7.8.

Gravedad CVSS v3.1: ALTA

Última modificación:

26/06/2026

CVE-2025-71382

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of service by supplying a maliciously crafted EPUB file with deeply nested HTML elements and inline CSS styles. The function value_from_inheritable_property() in css-apply.c recurses through the CSS property inheritance chain without a depth limit, exhausting the process stack and causing a crash in any application using MuPDF for EPUB rendering.

Gravedad CVSS v4.0: ALTA

Última modificación:

14/07/2026

CVE-2026-0864

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** When using the "configparser" module to write configuration files<br /> containing multi-line text values with carriage return characters (\r) the<br /> resulting file could be injected with unexpected keys and values if the<br /> attacker controls the written value.

Gravedad CVSS v4.0: MEDIA

Última modificación:

06/08/2026

CVE-2025-61024

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

Gravedad CVSS v3.1: ALTA

Última modificación:

23/06/2026

CVE-2025-61029

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

Gravedad CVSS v3.1: ALTA

Última modificación:

23/06/2026

CVE-2020-9713

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Gravedad CVSS v3.1: MEDIA

Última modificación:

26/06/2026

Suscribirse a Vulnerabilidades