Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2025-67822
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated attacker to conduct an authentication bypass attack due to improper authentication mechanisms. A successful exploit could allow an attacker to gain unauthorized access to user or admin accounts in the system.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
21/01/2026

CVE-2023-7334
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** Changjetong T+ versions up to and including 16.x contain a .NET deserialization vulnerability in an AjaxPro endpoint that can lead to remote code execution. A remote attacker can send a crafted request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehouseByStore with a malicious JSON body that leverages deserialization of attacker-controlled .NET types to invoke arbitrary methods such as System.Diagnostics.Process.Start. This can result in execution of arbitrary commands in the context of the T+ application service account. Exploitation evidence was observed by the Shadowserver Foundation as early as 2023-08-19 (UTC).
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
23/01/2026

CVE-2011-10041
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** Uploadify WordPress plugin versions up to and including 1.0 contain an arbitrary file upload vulnerability in process_upload.php due to missing file type validation. An unauthenticated remote attacker can upload arbitrary files to the affected WordPress site, which may allow remote code execution by uploading executable content to a web-accessible location.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
20/01/2026

CVE-2026-21920
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).<br /> <br /> <br /> <br /> <br /> If an SRX Series device configured for DNS processing, receives a specifically formatted DNS request flowd will crash and restart, which causes a service interruption until the process has recovered.<br /> <br /> This issue affects Junos OS on SRX Series:<br /> <br /> <br /> <br /> * 23.4 versions before 23.4R2-S5,<br /> * 24.2 versions before 24.2R2-S1,<br /> * 24.4 versions before 24.4R2.<br /> <br /> <br /> <br /> <br /> <br /> <br /> This issue does not affect Junos OS versions before 23.4R1.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/01/2026

CVE-2026-21921
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** A Use After Free vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker authenticated with low privileges to cause a Denial-of-Service (DoS).<br /> <br /> When telemetry collectors are frequently subscribing and unsubscribing to sensors continuously over a long period of time, telemetry-capable processes like chassisd, rpd or mib2d will crash and restart, which - depending on the process - can cause a complete outage until the system has recovered.<br /> <br /> This issue affects:<br /> <br />  Junos OS: <br /> <br /> <br /> <br /> * all versions before 22.4R3-S8,<br /> * 23.2 versions before 23.2R2-S5,<br /> * 23.4 versions before 23.4R2;<br /> <br /> <br /> <br /> <br /> Junos OS Evolved:<br /> <br /> <br /> <br /> * all versions before 22.4R3-S8-EVO,<br /> * 23.2 versions before 23.2R2-S5-EVO,<br /> * 23.4 versions before 23.4R2-EVO.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/01/2026

CVE-2026-21918
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** A Double Free vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of packets is encountered a double free happens. This causes flowd to crash and the respective FPC to restart.<br /> <br /> <br /> <br /> <br /> <br /> This issue affects Junos OS on SRX and MX Series:<br /> <br /> <br /> <br /> * all versions before 22.4R3-S7,<br /> * 23.2 versions before 23.2R2-S3,<br /> * 23.4 versions before 23.4R2-S4,<br /> * 24.2 versions before 24.2R2.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/01/2026

CVE-2026-21912
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the method to collect FPC Ethernet firmware statistics of Juniper Networks Junos OS on MX10k Series allows a local, low-privileged attacker executing the &amp;#39;show system firmware&amp;#39; CLI command to cause an LC480 or LC2101 line card to reset.<br /> <br /> On MX10k Series systems with LC480 or LC2101 line cards, repeated execution of the &amp;#39;show system firmware&amp;#39; CLI command can cause the line card to crash and restart. Additionally, some time after the line card crashes, chassisd may also crash and restart, generating a core dump.This issue affects Junos OS on MX10k Series: <br /> <br /> <br /> <br /> * all versions before 21.2R3-S10, <br /> * from 21.4 before 21.4R3-S9, <br /> * from 22.2 before 22.2R3-S7, <br /> * from 22.4 before 22.4R3-S6, <br /> * from 23.2 before 23.2R2-S2, <br /> * from 23.4 before 23.4R2-S3, <br /> * from 24.2 before 24.2R2.
Gravedad CVSS v4.0: MEDIA
Última modificación:
16/01/2026

CVE-2026-21911
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** An Incorrect Calculation vulnerability in the Layer 2 Control<br /> <br /> Protocol <br /> <br /> Daemon (l2cpd) of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker flapping the management interface to cause the learning of new MACs over label-switched interfaces (LSI) to stop while generating a flood of logs, resulting in high CPU usage.<br /> <br /> When the issue is seen, the following log message will be generated:<br /> <br /> op:1 flag:0x6 mac:xx:xx:xx:xx:xx:xx bd:2 ifl:13302 reason:0(REASON_NONE) i-op:6(INTRNL_OP_HW_FORCE_DELETE) status:10 lstatus:10 err:26(GETIFBD_VALIDATE_FAILED) err-reason 4(IFBD_VALIDATE_FAIL_EPOCH_MISMATCH) hw_wr:0x4 ctxsync:0 fwdsync:0 rtt-id:51 p_ifl:0 fwd_nh:0 svlbnh:0 event:- smask:0x100000000 dmask:0x0 mplsmask 0x1 act:0x5800 extf:0x0 pfe-id 0 hw-notif-ifl 13302 programmed-ifl 4294967295 pseudo-vtep underlay-ifl-idx 0 stack:GET_MAC, ALLOCATE_MAC, GET_IFL, GET_IFF, GET_IFBD, STOP, <br /> <br /> <br /> This issue affects Junos OS Evolved: <br /> <br /> * all versions before 21.4R3-S7-EVO, <br /> * from 22.2 before 22.2R3-S4-EVO, <br /> * from 22.3 before 22.3R3-S3-EVO, <br /> * from 22.4 before 22.4R3-S2-EVO, <br /> * from 23.2 before 23.2R2-S1-EVO, <br /> * from 23.4 before 23.4R1-S2-EVO, 23.4R2-EVO.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/01/2026

CVE-2026-21913
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** An Incorrect Initialization of Resource vulnerability in the Internal Device Manager (IDM) of Juniper Networks Junos OS on EX4000 models allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).<br /> <br /> On EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) a high volume of traffic destined to the device will cause an FXPC crash and restart, which leads to a complete service outage until the device has automatically restarted.<br /> <br /> <br /> <br /> <br /> The following reboot reason can be seen in the output of &amp;#39;show chassis routing-engine&amp;#39; and as a log message:<br /> <br />   reason=0x4000002 reason_string=0x4000002:watchdog + panic with core dump <br /> <br /> <br /> <br /> <br /> This issue affects Junos OS on EX4000-48T, EX4000-48P and EX4000-48MP:<br /> <br /> <br /> <br /> * 24.4 versions before 24.4R2,<br /> * 25.2 versions before 25.2R1-S2, 25.2R2.<br /> <br /> <br /> <br /> <br /> This issue does not affect versions before 24.4R1 as the first Junos OS version for the EX4000 models was 24.4R1.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/01/2026

CVE-2026-21914
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** An Improper Locking vulnerability in the GTP plugin of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (Dos).<br /> <br /> If an SRX Series device receives a specifically malformed GPRS Tunnelling Protocol (GTP) Modify Bearer Request message, a lock is acquired and never released. This results in other threads not being able to acquire a lock themselves, causing a watchdog timeout leading to FPC crash and restart. This issue leads to a complete traffic outage until the device has automatically recovered.<br /> <br /> This issue affects Junos OS on SRX Series:<br /> <br /> * all versions before 22.4R3-S8,<br /> * 23.2 versions before 23.2R2-S5,<br /> * 23.4 versions before 23.4R2-S6,<br /> * 24.2 versions before 24.2R2-S3,<br /> * 24.4 versions before 24.4R2-S2,<br /> * 25.2 versions before 25.2R1-S1, 25.2R2.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/01/2026

CVE-2026-21917
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** An Improper Validation of Syntactic Correctness of Input vulnerability in the Web-Filtering module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).<br /> <br /> If an SRX device configured for UTM Web-Filtering receives a specifically malformed SSL packet, this will cause an FPC crash and restart.<br /> This issue affects Junos OS on SRX Series:<br /> <br /> <br /> <br /> * 23.2 versions from 23.2R2-S2 before 23.2R2-S5, <br /> * 23.4 versions from 23.4R2-S1 before 23.4R2-S5,<br /> * 24.2 versions before 24.2R2-S2,<br /> * 24.4 versions before 24.4R1-S3, 24.4R2.<br /> <br /> <br /> Earlier versions of Junos are also affected, but no fix is available.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/01/2026

CVE-2026-21910
Fecha de publicación:
15/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on EX4k Series and QFX5k Series platforms allows an unauthenticated network-adjacent attacker flapping an interface to cause traffic between VXLAN Network Identifiers (VNIs) to drop, leading to a Denial of Service (DoS).<br /> <br /> On all EX4k and QFX5k platforms, a link flap in an<br /> <br /> EVPN-VXLAN configuration Link Aggregation Group (LAG)<br /> results in Inter-VNI traffic dropping when there are multiple load-balanced next-hop routes for the same destination.<br /> <br /> This issue is only applicable to systems that support EVPN-VXLAN Virtual Port-Link Aggregation Groups (VPLAG), such as the QFX5110, QFX5120, QFX5200, EX4100, EX4300, EX4400, and EX4650.<br /> <br /> Service can only be restored by restarting the affected FPC via the &amp;#39;request chassis fpc restart slot &amp;#39; command.<br /> <br /> This issue affects Junos OS <br /> <br /> on EX4k and QFX5k Series: <br /> <br /> <br /> <br /> * all versions before 21.4R3-S12, <br /> * all versions of 22.2<br /> * from 22.4 before 22.4R3-S8, <br /> * from 23.2 before 23.2R2-S5, <br /> * from 23.4 before 23.4R2-S5, <br /> * from 24.2 before 24.2R2-S3,<br /> * from 24.4 before 24.4R2.
Gravedad CVSS v4.0: ALTA
Última modificación:
16/01/2026
Suscribirse a Vulnerabilidades