Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-93657

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip() APIs, allowing invalid records to be returned as successful results. Attackers controlling the answering zone or positioned on the network path can have forged DNS records accepted as validated, bypassing DNSSEC authentication checks.

Gravedad CVSS v4.0: ALTA

Última modificación:

22/09/2026

CVE-2026-93676

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications.

Gravedad CVSS v3.1: BAJA

Última modificación:

22/09/2026

CVE-2026-93659

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts or exfiltrate data.

Gravedad CVSS v4.0: ALTA

Última modificación:

28/09/2026

CVE-2026-93576

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.

Gravedad CVSS v3.1: ALTA

Última modificación:

25/09/2026

CVE-2026-93573

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Netty&#39;s HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.

Gravedad CVSS v3.1: MEDIA

Última modificación:

09/10/2026

CVE-2026-93566

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

Gravedad CVSS v3.1: MEDIA

Última modificación:

09/10/2026

CVE-2026-93565

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

Gravedad CVSS v3.1: ALTA

Última modificación:

10/10/2026

CVE-2026-93567

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Netty&#39;s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.

Gravedad CVSS v3.1: ALTA

Última modificación:

10/10/2026

CVE-2026-93568

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty&#39;s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.

Gravedad CVSS v3.1: ALTA

Última modificación:

10/10/2026

CVE-2026-93569

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty&#39;s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.

Gravedad CVSS v3.1: ALTA

Última modificación:

10/10/2026

CVE-2026-93506

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called 05b4f9efeb79e9d72a693232334d7529687f896f. It is best practice to apply a patch to resolve this issue.

Gravedad CVSS v4.0: MEDIA

Última modificación:

22/09/2026

CVE-2026-93558

Fecha de publicación:

18/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Netty&#39;s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

Gravedad CVSS v3.1: ALTA

Última modificación:

10/10/2026

Suscribirse a Vulnerabilidades