Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-91147

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service.

Gravedad CVSS v3.1: MEDIA

Última modificación:

22/09/2026

CVE-2026-91149

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/09/2026

CVE-2026-85478

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.

Gravedad CVSS v4.0: BAJA

Última modificación:

21/09/2026

CVE-2026-85497

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** CareCam CM2507 IP cameras store the device&#39;s root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

21/09/2026

CVE-2026-81505

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy&#39;s GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID() and fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant&#39;s Source identifier and receive that Source&#39;s complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials. The list endpoint remains project-scoped; the single-item Source lookup is affected. This issue is fixed in version 26.6.8.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/09/2026

CVE-2026-77608

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, when the `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/09/2026

CVE-2026-77609

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, `Special:URIResolver` resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to `$title->getFullURL()` without validating the resolved target. A crafted subpage can make that target point off-host: an interwiki prefix redirects to the foreign wiki (for example `Special:URIResolver/mw-3AFoo`, which decodes to `mw:Foo`, redirects to `https://www.mediawiki.org/wiki/Foo`), and where the resolved URL carries an authority the target can even embed `user:pass@host` credentials. The result is an open redirect to an attacker-influenced host, usable for phishing from a trusted wiki URL. Version 7.2.0 fixes the issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/09/2026

CVE-2026-77610

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, query debug output (`format=debug`, or the `debug` request parameter on `Special:Ask`) is assembled by `SMW\Query\DebugFormatter` and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is reflected into the page without escaping. On `Special:Ask` the resulting string is concatenated into the page and sent through `OutputPage::addHTML`, never through the MediaWiki parser or Sanitizer. No special user right is required; an anonymous request suffices. This is a reflected XSS: the payload is taken from the request and echoed in the same response. Exploitation requires the query condition to target a text/blob-typed property (whose value is re-serialized verbatim); the predefined `_txt` properties (`Text`, etc.) that ship on every install satisfy this, so no attacker-created content is needed. Version 7.2.0 patches the issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/09/2026

CVE-2026-77616

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. In versions 7.0.0 through 7.1.0, `Special:Ask` accepts a `cursor` query parameter for keyset pagination (added in 7.0.0). The token is decoded by `CursorEncoder`, which is an **unsigned** base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the cursor&#39;s sort anchor does not match the request&#39;s `sort=` / `order=`, `QueryCreator::applyCursorIfRequested()` builds an error message by interpolating the attacker-controlled `sort_prop` / `sort_order` values into a raw string via `Query::addErrors()`. Unlike SMW&#39;s message-key errors, this raw string bypasses the message layer&#39;s sanitization (`ProcessingErrorMsgHandler::normalizeAndDecodeMessages()` passes a non-key, non-encoded string through unchanged). `ErrorWidget::queryError()` then assembles the errors and passes them to `Html::errorBox()`, whose first argument is emitted as raw HTML. The result is a reflected cross-site scripting vulnerability: a crafted `cursor` token containing markup in `sort_prop` (or `sort_order`) executes script in the victim&#39;s browser on the wiki origin. No authentication or special permission is required. The payload is delivered via a crafted link. Version 7.2.0 contains a fix.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/09/2026

CVE-2026-77301

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry&#39;s central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompression handling to commit excessive resident memory before CRC validation reports an error. Applications that read entries from untrusted archives can therefore be terminated by the operating system or suffer service-wide memory exhaustion. This issue is fixed in version 0.6.1.

Gravedad CVSS v3.1: ALTA

Última modificación:

24/09/2026

CVE-2026-73863

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ&#39;s broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_parser.c reuses len_of_varint from the outer Properties Length while parsing each SUBSCRIPTION_IDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing get_var_integer() to begin at an incorrect offset and read beyond the heap message buffer. The flaw is reachable through the broker receive path and can crash the broker, while the separately reported topic-option off-by-one occurs later and is not this vulnerability. This issue is fixed in version 0.24.14.

Gravedad CVSS v4.0: ALTA

Última modificación:

24/09/2026

CVE-2026-77606

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, when `headers=plain`, table header text was emitted into `` via a raw HTML path. User-controlled `mainlabel` content could therefore become executable HTML. Version 7.2.0 fixes the issue.

Gravedad CVSS v3.1: MEDIA

Última modificación:

24/09/2026

Suscribirse a Vulnerabilidades