Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-73421

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth() wrapper can fail open when Auth.js has a server configuration error. In middleware, Route Handlers, React Server Components, and other auth() entry points, a non-OK session response is parsed into a truthy error object instead of null, so checks such as !!auth and if (req.auth) evaluate to true for unauthenticated requests. A provider missing both the issuer and authorization endpoint triggers InvalidEndpoints, and an unset AUTH_SECRET or another server configuration error can produce the same behavior. There is no impact while configuration is valid, but after a deployment becomes misconfigured, routes protected only by session existence silently grant access to every visitor. This issue is fixed in next-auth 5.0.0-beta.32.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

18/08/2026

CVE-2026-73304

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve the identity-provider credentials of SSO-authenticated users and use the refresh tokens for persistent access to connected services. This issue is fixed in version 3.39.25.

Gravedad CVSS v3.1: MEDIA

Última modificación:

14/08/2026

CVE-2026-72857

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.

Gravedad CVSS v4.0: ALTA

Última modificación:

14/08/2026

CVE-2026-73302

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an email_verified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used users.getGlobalUserByEmail as a fallback account-linking key. An attacker who can authenticate through a configured identity provider that asserts a victim email as unverified can have a fresh provider identity merged into the victim Budibase account and inherit the victim roles. This issue is fixed in version 3.39.30.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

14/08/2026

CVE-2026-73408

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait for a Budibase administrator to run schema discovery, causing the second statement to execute. The fix applies quoteMySqlIdentifier before constructing the query. This issue is fixed in version 3.39.18.

Gravedad CVSS v3.1: ALTA

Última modificación:

14/08/2026

CVE-2026-73039

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users&#39; viewing status records. Attackers can enumerate all users&#39; watch progress, delete arbitrary viewing history, and manipulate other users&#39; Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.

Gravedad CVSS v4.0: MEDIA

Última modificación:

14/08/2026

CVE-2026-73416

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab&#39;s PyPI extension manager enforces blocked_extensions_uris by comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install request even though pip resolves the variant to the same package. Security impact requires an allowlist or blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited extension, defeat integrity restrictions, and affect availability without gaining new read access. This issue is fixed in versions 4.5.10 and 4.6.2.

Gravedad CVSS v4.0: MEDIA

Última modificación:

17/08/2026

CVE-2026-73305

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, exposing that app data, datasource configuration, and automations. This issue is fixed in version 3.39.24.

Gravedad CVSS v3.1: ALTA

Última modificación:

18/08/2026

CVE-2026-72850

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

14/08/2026

CVE-2026-72855

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.

Gravedad CVSS v4.0: ALTA

Última modificación:

14/08/2026

CVE-2026-72851

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

14/08/2026

CVE-2026-72849

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim&#39;s account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user&#39;s account, enabling impersonation within agent operations and inheritance of victim permissions.

Gravedad CVSS v4.0: ALTA

Última modificación:

17/08/2026

Suscribirse a Vulnerabilidades