Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-90449

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway&#39;s own authentication requirement first. All access control for this administrative interface, which manages the credential store used to gate every other service in the deployment, is delegated entirely to that third-party interface&#39;s own login mechanism. Any authentication weakness in that bundled interface would compromise the credential store protecting the rest of the deployment.

Gravedad CVSS v4.0: MEDIA

Última modificación:

02/10/2026

CVE-2026-90450

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** The application&#39;s role-authorization lookup defaults to granting access when a request handler&#39;s name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered in this table is reachable by any authenticated user regardless of their assigned role, and any newly added handler is fail-open by default until explicitly added to the table.

Gravedad CVSS v4.0: MEDIA

Última modificación:

02/10/2026

CVE-2026-90451

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value will use the known default, allowing an attacker aware of the default to forge valid authentication cookies for that component.

Gravedad CVSS v4.0: ALTA

Última modificación:

02/10/2026

CVE-2026-90443

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and can redirect the user&#39;s browser to an arbitrary external site. Successful exploitation could allow an attacker to act with the compromised user&#39;s session privileges within the application.

Gravedad CVSS v4.0: MEDIA

Última modificación:

02/10/2026

CVE-2026-90444

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file&#39;s name, allowing an authenticated attacker to embed and execute arbitrary operating system commands with the privileges of that process. This allows an attacker to read and modify ingested log data, and could provide a foothold for further movement within the internal network.

Gravedad CVSS v4.0: ALTA

Última modificación:

02/10/2026

CVE-2026-90445

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process. This could allow an attacker to inject fabricated records into the system&#39;s stored data or tamper with application configuration.

Gravedad CVSS v4.0: ALTA

Última modificación:

02/10/2026

CVE-2026-90446

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application&#39;s own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.

Gravedad CVSS v4.0: MEDIA

Última modificación:

02/10/2026

CVE-2026-90447

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this header to route around the primary role-based authorization check and reach the alternate path&#39;s fixed, elevated role instead. This allows a low-privileged authenticated attacker who knows the shared credential to perform actions reserved for a higher-privileged role.

Gravedad CVSS v4.0: ALTA

Última modificación:

02/10/2026

CVE-2026-90448

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application&#39;s own elevated backend credentials. This allows an authenticated user on a deployment intended to be read-only to forge or overwrite stored records that should not be modifiable in that deployment mode.

Gravedad CVSS v4.0: ALTA

Última modificación:

02/10/2026

CVE-2026-54258

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI correctly hides the restricted monitor and its events, but direct event media views accept an arbitrary `eid` and stream media from the event path without enforcing the event/monitor-level ACL. This exposes private surveillance footage across monitor boundaries. Versions 1.36.39, 1.38.4, and 1.39.11 fix the issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/09/2026

CVE-2026-54240

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/09/2026

CVE-2026-54241

Fecha de publicación:

11/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/09/2026

Suscribirse a Vulnerabilidades