Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-103396

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/09/2026

CVE-2026-103398

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/09/2026

CVE-2026-103397

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

Gravedad CVSS v4.0: MEDIA

Última modificación:

02/10/2026

CVE-2026-103395

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

30/09/2026

CVE-2026-103388

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP&#39;s FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source. When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim&#39;s browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim. Preconditions: - Attacker must hold galaxy editor privileges (local or via sync). - Victim must view the affected cluster and click the malicious link. Impact: - Stored cross-site scripting (XSS) in the victim&#39;s browser. - Potential session theft, credential harvesting, or unauthorized actions within the MISP application. Affected:

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/09/2026

CVE-2026-103389

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored value was subsequently concatenated directly into HTML markup by the D3-based correlation graph rendering scripts (both the default and Overmind themes) using the .html() method. A user holding the perm_galaxy_editor permission, which is granted to the stock User role, could store arbitrary HTML or JavaScript in the icon field. Any other user who opened the correlation graph of an event containing a cluster belonging to that galaxy would have the injected script executed in their browser session. Impact: - Arbitrary script execution in the context of the victim&#39;s MISP session - Potential theft of session credentials, manipulation of displayed data, or initiation of actions on behalf of the victim - Affects both the default and Overmind UI themes Affected versions:

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/09/2026

CVE-2026-103227

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.

Gravedad CVSS v4.0: MEDIA

Última modificación:

02/10/2026

CVE-2026-103243

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.

Gravedad CVSS v4.0: MEDIA

Última modificación:

02/10/2026

CVE-2026-103270

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/09/2026

CVE-2026-103226

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was identified in Artifex Ghostscript up to 10.09.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is suggested to install a patch to address this issue. A solution was implemented: "I&#39;ve chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of &#39;normal&#39; usage."

Gravedad CVSS v4.0: BAJA

Última modificación:

30/09/2026

CVE-2026-103222

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.

Gravedad CVSS v4.0: MEDIA

Última modificación:

30/09/2026

CVE-2026-102984

Fecha de publicación:

30/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3.

Gravedad CVSS v4.0: ALTA

Última modificación:

30/09/2026

Suscribirse a Vulnerabilidades