Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-10644

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Microchip SERCOM-G1 UART driver (drivers/serial/uart_mchp_sercom_g1.c), used by the PIC32CM-JH SoC family, contains an out-of-bounds write in its asynchronous (DMA) receive path. When uart_rx_enable() is invoked with a one-byte receive buffer (len == 1) and CONFIG_UART_MCHP_ASYNC is enabled, the RX-complete ISR starts a single-beat DMA transfer while a received byte is already pending in the SERCOM DATA register. On this SoC the peripheral-triggered DMA start sequencing then writes one byte past the end of the caller-supplied buffer (CWE-787). The overflowed byte&#39;s value is the UART RX data supplied by the connected serial peer (adjacent attacker), while its size and location are fixed at one byte immediately after the buffer. Exploitation requires the async UART config (not enabled by default on the in-tree PIC32CM-JH boards) and a consumer that enables RX with a one-byte buffer; impact is limited single-byte memory corruption adjacent to the RX buffer (possible crash / denial of service). The defect shipped in v4.4.0. The fix reads the first byte with the CPU and, for one-byte buffers, performs no DMA at all; for larger buffers it sizes the DMA for the remaining len-1 bytes.

Gravedad CVSS v3.1: MEDIA

Última modificación:

14/07/2026

CVE-2026-58058

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/06/2026

CVE-2026-58056

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** RustDesk gates incoming control messages on per-capability flags rather than on the session&#39;s authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.

Gravedad CVSS v4.0: ALTA

Última modificación:

18/07/2026

CVE-2026-58057

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Flowise before 3.1.3 validates Custom MCP stdio environment variables against a denylist using a case-sensitive comparison, so on Windows, where environment names are case-insensitive, supplying &#39;node_options&#39; bypasses the NODE_OPTIONS denylist entry. An authenticated user who can configure a Custom MCP node can thereby inject NODE_OPTIONS --require and execute arbitrary code in the Flowise server context.

Gravedad CVSS v4.0: BAJA

Última modificación:

06/07/2026

CVE-2026-58053

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow&#39;s container.options string to the Docker job container&#39;s HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with host namespaces and broad capabilities and escape to the host as root despite privileged mode being disabled.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

30/06/2026

CVE-2026-58055

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** nghttp2&#39;s nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker&#39;s favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/06/2026

CVE-2026-58051

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/06/2026

CVE-2026-58050

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/06/2026

CVE-2026-58052

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** 7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name &#39;Zone.Identifier&#39; while a RAR5 STM record named &#39;:Zone.Identifier:$DATA&#39; is not matched and NTFS canonicalizes it to the same stream, overwriting the propagated Internet-zone marker with ZoneId=0. A second STM record named &#39;::$DATA&#39; overwrites the extracted file&#39;s default data stream, letting an attacker defeat SmartScreen/MotW warnings and spoof file content.

Gravedad CVSS v4.0: MEDIA

Última modificación:

07/08/2026

CVE-2026-58054

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. This CVE was assigned on the basis that the permission system allows a limited administrator to grant privileges exceeding their own authorization scope, potentially constituting an insecure default configuration. Following a dispute, the MITRE TL-Root determined the behavior reflects documented and intended product design rather than a security vulnerability.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/07/2026

CVE-2026-58049

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** FFmpeg&#39;s RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption.

Gravedad CVSS v4.0: ALTA

Última modificación:

12/08/2026

CVE-2026-8095

Fecha de publicación:

28/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path that is then passed directly to unlink() in delete_file_locally() without any directory containment validation. This makes it possible for authenticated attackers with Subscriber-level access to delete arbitrary files on the server, including sensitive files such as wp-config.php, potentially leading to full site takeover.

Gravedad CVSS v3.1: ALTA

Última modificación:

29/06/2026

Suscribirse a Vulnerabilidades