Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-25199
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.<br /> <br /> <br /> <br /> <br /> This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0.<br /> <br /> <br /> <br /> <br /> The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine.<br /> <br /> <br /> <br /> <br /> Users are recommended to upgrade to version 4.22.0.1, which fixes this issue.<br /> <br /> <br /> <br /> <br /> As a workaround for the existing installations, editing of the proxmox_vmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm.denied.details.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
09/05/2026

CVE-2026-25077
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack.<br /> <br /> <br /> Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.
Gravedad CVSS v3.1: ALTA
Última modificación:
10/05/2026

CVE-2025-69233
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are able to exceed the allocation limits configured for their accounts/domains. This can be used by an attacker to degrade the infrastructure&amp;#39;s resources and lead to denial of service conditions.<br /> <br /> Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.
Gravedad CVSS v3.1: MEDIA
Última modificación:
09/05/2026

CVE-2025-66467
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write access to it by using the previously generated access and secret keys.<br /> <br /> Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.
Gravedad CVSS v3.1: ALTA
Última modificación:
11/05/2026

CVE-2025-66170
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup.<br /> <br /> Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.
Gravedad CVSS v3.1: MEDIA
Última modificación:
11/05/2026

CVE-2025-66172
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user&amp;#39;s backups and attach the volume to their own VMs.<br /> <br /> Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
Gravedad CVSS v3.1: ALTA
Última modificación:
12/05/2026

CVE-2025-66171
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the environment.<br /> <br /> Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
Gravedad CVSS v3.1: MEDIA
Última modificación:
12/05/2026

CVE-2022-50994
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit unsanitized input passed to the otp_check.sh script to achieve remote code execution with web server privileges. Exploitation requires knowledge of a valid username and that the target account has MOTP authentication enabled.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
08/05/2026

CVE-2026-3318
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in the login form endpoint, where the ‘returnUrl’ parameter allows redirection because the web application accepts a URL as a parameter without properly validating it. As a result, it is possible to redirect users from the legitimate website to external pages. An attacker could exploit this vulnerability to deceive users and redirect them from a trusted URL to a malicious one without their knowledge.
Gravedad CVSS v4.0: MEDIA
Última modificación:
08/05/2026

CVE-2026-8076
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This could allow an attacker to easily perform a brute-force attack against a user and gain access by trying different PINs without the account being locked. Successful exploitation of this vulnerability could result in unauthorized access to confidential configuration settings, compromising the security of the system.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
08/05/2026

CVE-2026-8153
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands that will execute code on the robot&amp;#39;s OS.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
11/05/2026

CVE-2026-7475
Fecha de publicación:
08/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `sky-custom-scripts` custom post type in all versions up to, and including, 3.3.2. This is due to the custom post type being registered with `capability_type =&gt; &amp;#39;post&amp;#39;` and `show_in_rest =&gt; true`, combined with insufficient input sanitization on the `sky_script_content` meta field and lack of output escaping when rendering scripts on the frontend. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts via the REST API that execute on every frontend page for all site visitors.
Gravedad CVSS v3.1: MEDIA
Última modificación:
08/05/2026
Suscribirse a Vulnerabilidades