Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-72687

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-72674

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-72675

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/08/2026

CVE-2026-72676

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Improper Control of Generation of Code (&#39;Code Injection&#39;) (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-72677

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/08/2026

CVE-2026-72678

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-72679

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-72680

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an authenticated user holding only the Agent Builder read privilege can supply an identifier already in use by another user in the same space and cause that user&#39;s conversation to be replaced and reassigned to the requesting account. The original owner permanently loses access to the conversation and its history. The impact is limited to loss of integrity and availability of the affected conversation; the attacker does not read the overwritten content.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-72683

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-72681

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature&#39;s functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

CVE-2026-72665

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live query privileges or the Elastic Defend response action privileges that normally govern those capabilities. Depending on the response action involved, this can result in disclosure of information from the affected hosts or in unauthorized changes to their state.

Gravedad CVSS v3.1: ALTA

Última modificación:

28/08/2026

CVE-2026-72666

Fecha de publicación:

13/08/2026

Idioma:

Inglés

*** Pendiente de traducción *** Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A user who is authorized to run Osquery live queries in one space can have a query carried out on hosts belonging to another space, resulting in disclosure of information from those hosts to the Osquery results data stream.

Gravedad CVSS v3.1: MEDIA

Última modificación:

28/08/2026

Suscribirse a Vulnerabilidades