Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2855▼ 333 respecto a la semana anterior
Críticas / altas1381▼ 36 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)296▼ 213 respecto a la semana anterior
–

570 resultados, ordenados por fecha de publicación (más recientes primero)

CVEEstadoSeveridadEPSS Explotación activaTecnologías afectadasPublicada ▼Modificada Descripción
AnalizadaAlta (8.7)0.62%—Bouncycastle Bc-javaBouncycastle Bouncy Castle FOR Java LTSBouncycastle Fips Java API3/8/20262/9/2026
In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
AnalizadaAlta (8.7)0.49%—Bouncycastle Bc-javaBouncycastle Bouncy Castle FOR Java LTSBouncycastle Fips Java API3/8/20262/9/2026
In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
AnalizadaCrítica (9.3)0.43%—Bouncycastle Bc-javaBouncycastle Bouncy Castle FOR Java LTSBouncycastle Fips Java API3/8/20262/9/2026
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).
AnalizadaMedia (6.9)0.29%—Bouncycastle Bc-java3/8/20262/9/2026
In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper.
AnalizadaAlta (7.1)0.24%—Bouncycastle Bc-javaBouncycastle Bouncy Castle FOR Java LTS3/8/20262/9/2026
In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity MAC key. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
AnalizadaCrítica (9.3)0.34%—Bouncycastle Bc-javaBouncycastle Bouncy Castle FOR Java LTS3/8/202631/8/2026
In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
AnalizadaAlta (8.7)0.49%—Bouncycastle Bc-javaBouncycastle Bcpg-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/20262/9/2026
In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
AnalizadaMedia (6.9)0.42%—Bouncycastle Bc-javaBouncycastle Bcpg-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, OpenPGP Argon2 S2K honours attacker-chosen memory and passes. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
AnalizadaMedia (6.9)0.42%—Bouncycastle Bc-javaBouncycastle Bcpkix-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, CRMF/CMP password-MAC honours unbounded iteration count. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
AnalizadaAlta (8.7)0.62%—Bouncycastle Bc-javaBouncycastle Bctls-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
AnalizadaAlta (8.7)0.49%—Bouncycastle Bc-javaBouncycastle Bcutil-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
AnalizadaAlta (8.7)0.49%—Bouncycastle Bc-java3/8/202631/8/2026
In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender.
AnalizadaAlta (8.7)0.24%—Bouncycastle Bc-javaBouncycastle Bcpg-fips3/8/202610/9/2026
In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.
AnalizadaAlta (8.7)0.30%—Bouncycastle Bc-javaBouncycastle Bcpkix-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
AnalizadaAlta (8.7)0.20%—Bouncycastle Bc-javaBouncycastle Bcjmail-fipsBouncycastle Bcmail-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X…
AnalizadaAlta (8.7)0.35%—Bouncycastle Bc-javaBouncycastle Bcpg-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series).
AnalizadaAlta (8.7)0.24%—Bouncycastle Bc-javaBouncycastle Bcpkix-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
AnalizadaCrítica (9.3)0.34%—Bouncycastle Bc-javaBouncycastle Bctls-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bctls-fips 1.0.24 (1.0.X series), 2.0.24 (2.0.X series) and 2.1.24 (2.1.X series).
AnalizadaMedia (5.3)0.34%—Bouncycastle Bc-javaBouncycastle Bcpkix-fipsBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).
En análisisAlta (7.1)0.29%—Bouncycastle Bc-javaBouncycastle Bouncy Castle FOR Java LTS3/8/202628/8/2026
In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
AplazadaMedia (4.3)0.14%—Podlove Podcast PublisherAI1/8/202626/8/2026
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.
AnalizadaAlta (8.2)0.34%—Bouncycastle Bc-java28/7/20261/10/2026
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure…
AplazadaMedia (5.3)0.29%—Sonaar MP3 Audio Player FOR Music Radio AND PodcastAI23/7/202623/7/2026
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
AplazadaMedia (5.3)0.38%—Broadcast Live VideoAI23/7/202623/7/2026
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
AplazadaBaja (1.7)0.14%—Legion OF THE Bouncy Castle INC Bc-ltsAILegion OF THE Bouncy Castle INC Bcprov-lts8onAI16/7/202617/7/2026
Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C.…
Orbitaley — Vulnerabilidades