Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-67173
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI.<br /> <br /> When a victim rendered the affected graph, the browser could resolve the attacker-controlled URI and initiate an unintended request or invoke scheme-specific handling in the victim’s context. Depending on the URI, browser behaviour, and installed protocol handlers, exploitation could disclose limited client or network metadata, facilitate rendering-based tracking, or attempt to access local or internal resources.<br /> <br /> Exploitation requires a victim to load or render graph data containing the malicious imagePath. The patch normalizes ASCII whitespace and control characters in URI schemes and restricts image paths to relative URLs or the http, https, data, and blob schemes.
Gravedad CVSS v4.0: MEDIA
Última modificación:
30/07/2026

CVE-2026-59878
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All.<br /> <br /> A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections.<br /> This issue affects Apache ActiveMQ AMQP: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8.<br /> <br /> Users are recommended to upgrade to version 5.19.9, 6.2.8, or 6.3.0 which fixes the issue.
Gravedad CVSS v3.1: ALTA
Última modificación:
28/07/2026

CVE-2026-61487
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.<br /> <br /> An authenticated low-privilege user can bypass a per-destination<br /> write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a<br /> comma-separated composite of real queues. This allows publishing messages to any of the destinations in the list without proper write ACL permissions because the authorization check is bypassed due to the composite destination being marked as temporary.<br /> This issue affects Apache ActiveMQ Broker: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ All: before 5.19.9, from 6.0.0 before 6.2.8; Apache ActiveMQ: before 5.19.9, from 6.0.0 before 6.2.8.<br /> <br /> Users are recommended to upgrade to version 5.19.9, 6.2.8 or 6.3.0, which fixes the issue.
Gravedad CVSS v3.1: MEDIA
Última modificación:
28/07/2026

CVE-2026-7187
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs.<br /> <br /> This issue affects UKBS: through 28072026.<br /> NOTE: The vendor was contacted and it was learned that the product is not supported.
Gravedad CVSS v3.1: ALTA
Última modificación:
04/08/2026

CVE-2026-66920
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing an excessively long path, deeply nested properties, or circular object references could therefore exhaust the JavaScript call stack when Pivotick calculates a layout or displays a node in the inspection modal.<br /> <br /> Successful exploitation may cause an uncaught exception, freeze the affected page, or crash the browser tab, resulting in a client-side denial of service. No confidentiality or integrity impact has been identified.<br /> <br /> The patch replaces the recursive graph traversals with iterative stack-based implementations and limits the reachability calculation to 1,000,000 edge traversals. It also limits JSON rendering to 64 levels and detects circular references before descending further into an object.
Gravedad CVSS v4.0: ALTA
Última modificación:
30/07/2026

CVE-2026-65881
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle
Gravedad CVSS v3.1: ALTA
Última modificación:
28/07/2026

CVE-2026-65882
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle
Gravedad CVSS v3.1: MEDIA
Última modificación:
28/07/2026

CVE-2026-66913
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.<br /> <br /> An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.<br /> <br /> The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.<br /> <br /> The patch introduces:<br /> <br /> * A 1 GB cumulative uncompressed-size limit for imported capture archives.<br /> * Size-limited gzip and zlib decompression for compressed HAR files.<br /> * Explicit detection and handling of suspected zip bombs.<br /> * An HTTP 400 response when an oversized compressed HAR file is submitted through the API.
Gravedad CVSS v4.0: MEDIA
Última modificación:
30/07/2026

CVE-2026-66918
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document.<br /> <br /> When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker able to influence graph data can provide crafted markup containing executable event handlers, such as an element with an onerror attribute.<br /> <br /> When a victim loads or renders the malicious graph, the payload may execute arbitrary JavaScript in the security context of the application embedding Pivotick. Successful exploitation could allow the attacker to access application data available to the victim, modify displayed content, or perform actions using the victim’s authenticated session.<br /> <br /> Exploitation requires an application using Pivotick to render graph data that is controlled or modified by an attacker.
Gravedad CVSS v4.0: ALTA
Última modificación:
30/07/2026

CVE-2026-66919
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers.<br /> <br /> An attacker able to supply or modify graph data could insert a malicious HTML or JavaScript payload into a node’s label or description. The payload would be parsed and executed in the application’s origin when a user opened the affected node’s inspect or edit modal.<br /> <br /> Successful exploitation could allow the attacker to access information available to the victim, modify application data, or perform actions using the victim’s active session.<br /> <br /> The vulnerability has been addressed by creating the modal elements without embedding graph data in HTML and assigning node labels and descriptions through textContent.
Gravedad CVSS v4.0: MEDIA
Última modificación:
30/07/2026

CVE-2026-62431
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** The logic to handle periodic Viridian STIMERs performs a division with an<br /> unchecked user-controlled divisor value, that can be set to zero to cause a #DE<br /> fault.
Gravedad CVSS v3.1: ALTA
Última modificación:
28/07/2026

CVE-2026-62432
Fecha de publicación:
28/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** The EVTCHNOP_expand_array hypercall checks for whether FIFO event<br /> channels are enabled, but without holding the correct lock. It can race<br /> with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Gravedad CVSS v3.1: ALTA
Última modificación:
28/07/2026
Suscribirse a Vulnerabilidades