Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-20338

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device.<br /> <br /> This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.

Gravedad CVSS v3.1: ALTA

Última modificación:

07/08/2026

CVE-2026-20339

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an affected device.<br /> <br /> This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.

Gravedad CVSS v3.1: ALTA

Última modificación:

07/08/2026

CVE-2026-19212

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument m_offsetType can lead to use of uninitialized variable. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Gravedad CVSS v4.0: BAJA

Última modificación:

08/08/2026

CVE-2026-17601

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without any additional authorization check or role reassignment.

Gravedad CVSS v4.0: ALTA

Última modificación:

07/08/2026

CVE-2026-17603

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

Gravedad CVSS v4.0: ALTA

Última modificación:

07/08/2026

CVE-2026-17597

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt outbound network connections to internal or otherwise restricted network addresses. Differences in the server&#39;s response could be used to infer whether internal hosts and ports are reachable. This issue affects Nexus Repository 3 CE/Pro versions up to and including 3.94.1, and is fixed in version 3.95.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

07/08/2026

CVE-2026-17596

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

07/08/2026

CVE-2026-17598

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.

Gravedad CVSS v4.0: MEDIA

Última modificación:

07/08/2026

CVE-2026-17599

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.

Gravedad CVSS v4.0: MEDIA

Última modificación:

07/08/2026

CVE-2026-17600

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Sonatype Nexus Repository 3 did not immediately terminate a user&#39;s active login session or revoke their cached permissions when that user&#39;s account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

Gravedad CVSS v4.0: ALTA

Última modificación:

07/08/2026

CVE-2026-17594

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

Gravedad CVSS v4.0: ALTA

Última modificación:

07/08/2026

CVE-2026-17593

Fecha de publicación:

07/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy Nexus Repository 2) could submit arbitrary values as realm identifiers through an internal configuration API that did not validate them against the set of registered realms. Because unrecognized entries were persisted and re-evaluated on every realm load via a legacy code path, this could result in unintended code executing inside the Nexus Repository process, and in some cases a persistent authentication lockout that was not visible through the administrative UI.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/08/2026

Suscribirse a Vulnerabilidades