Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-72786

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user&#39;s password including administrators by exploiting the unprotected newPassword field in the User element save flow.

Gravedad CVSS v4.0: ALTA

Última modificación:

13/08/2026

CVE-2026-6821

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

Gravedad CVSS v3.1: MEDIA

Última modificación:

19/08/2026

CVE-2026-72508

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leverage a highly privileged ServiceAccount (SA). This enables the tenant to deploy arbitrary cluster-scoped resources, leading to privilege escalation and potential arbitrary code execution across the cluster.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

27/08/2026

CVE-2026-67579

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer.<br /> <br /> Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call.<br /> <br /> This issue affects ash: from 1.17.0 before 3.31.3.

Gravedad CVSS v4.0: ALTA

Última modificación:

18/08/2026

CVE-2026-63299

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

12/08/2026

CVE-2026-63293

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

13/08/2026

CVE-2026-63294

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

13/08/2026

CVE-2026-63300

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restrictions. When migrating an instance between projects, LXD fails to validate the instance&#39;s configuration against the target project&#39;s enforced restrictions (such as restricted.containers.lowlevel, restricted.devices.*, and restricted.networks.access). An attacker can exploit this by creating a disallowed or high-privilege instance in an unrestricted project and subsequently moving it into the restricted project.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

13/08/2026

CVE-2026-63295

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges (such as enforcing restricted.containers.privilege=isolated), LXD fails to enforce the requirement if an instance configuration omits the security.idmap.isolated key. An attacker can exploit this flaw by creating or updating an instance without explicitly setting security.idmap.isolated, bypassing the target project&#39;s security constraints.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/08/2026

CVE-2026-63296

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD accepts configuration overrides without validating the new configuration against the target project&#39;s enforced restrictions. An attacker can exploit this flaw to move instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

13/08/2026

CVE-2026-63297

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD performs restriction checks before configuration merging is complete, creating a time-of-check to time-of-use (TOCTOU) condition. An attacker can exploit this flaw to copy instances with disallowed high-privilege configurations into restricted projects, bypassing security controls.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

13/08/2026

CVE-2026-63298

Fecha de publicación:

12/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** An improper neutralization of special elements vulnerability in LXD&#39;s NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the &#39;nvidia.driver.capabilities&#39; or &#39;nvidia.require.*&#39; configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

13/08/2026

Suscribirse a Vulnerabilidades