Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-44987

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers&#39; passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.

Gravedad CVSS v3.1: BAJA

Última modificación:

13/05/2026

CVE-2026-42456

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/workspace/:slug/tts/:chatId in AnythingLLM returns the text-to-speech audio for another user&#39;s chat response within the same workspace because the route validates workspace membership but does not enforce ownership of the targeted chat row. As a result, an authenticated user can access another user&#39;s private assistant response in audio form if the chatId is known or guessed. This constitutes an insecure direct object reference (IDOR) affecting private chat response content exposed through the TTS endpoint. This issue has been patched in version 1.12.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/05/2026

CVE-2026-44656

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim&#39;s :find command-line completion. When the path option contains backtick-enclosed shell commands, those commands are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing an attacker who controls the contents of a file to execute arbitrary shell commands when the user opens that file in Vim and triggers :find completion. This issue has been patched in version 9.2.0435.

Gravedad CVSS v4.0: MEDIA

Última modificación:

14/05/2026

CVE-2026-42452

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, /users/login issues a temporary JWT (temp_token) for TOTP-enabled accounts. That token carries a pendingTOTP state and should only be valid for the second-factor flow. However, the auth middleware accepts this token on regular authenticated endpoints. This effectively turns 2FA into single-factor (password) for impacted accounts. This issue has been patched in version 2.1.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

12/05/2026

CVE-2026-42453

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operations which use single-quote escaping. Double quotes allow $(command) substitution, enabling command injection on the remote SSH host. This issue has been patched in version 2.1.0.

Gravedad CVSS v4.0: ALTA

Última modificación:

12/05/2026

CVE-2026-42351

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi&#39;s STAC FileSystemProvider plugin can allow for requests to STAC collection based collections to expose directories without authentication. The issue manifests when pygeoapi is deployed without a proxy or web front end that would normalize URLs with .. values, along with a resource of type stac-collection defined in configuration. This issue has been patched in version 0.23.3.

Gravedad CVSS v3.1: ALTA

Última modificación:

12/05/2026

CVE-2026-42352

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.

Gravedad CVSS v3.1: ALTA

Última modificación:

12/05/2026

CVE-2026-42354

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

13/05/2026

CVE-2026-42350

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Kargo manages and automates the promotion of software artifacts. Prior to versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2, Kargo is vulnerable to open redirect in UI OIDC login flow via the redirectTo query parameter. This issue has been patched in versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2.

Gravedad CVSS v4.0: MEDIA

Última modificación:

13/05/2026

CVE-2026-42451

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in Grimmory&#39;s browser-based EPUB reader allows an attacker to embed arbitrary JavaScript in a crafted EPUB file. When a victim opens the book, the script executes in their browser with full access to the Grimmory application&#39;s session context. This can enable session token theft and account takeover, including administrative access if an administrator opens the affected book. This issue has been patched in version 2.3.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

13/05/2026

CVE-2026-42344

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT&#39;s isInternalAddress() function in packages/service/common/system/utils.ts is vulnerable to DNS rebinding (TOCTOU — Time-of-Check to Time-of-Use). The function resolves the hostname via dns.resolve4()/dns.resolve6() and checks resolved IPs against private ranges, but the actual HTTP request happens in a separate call with a new DNS resolution, allowing the DNS record to change between validation and fetch. At time of publication, there are no publicly available patches.

Gravedad CVSS v3.1: MEDIA

Última modificación:

12/05/2026

CVE-2026-42345

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT&#39;s isInternalAddress() function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith() check against a hardcoded list. This check can be bypassed using at least 7 different URL encoding techniques, all of which resolve to the same cloud metadata service but do not match the blocklist patterns. Additionally, the broader private IP check (isInternalIPv4/isInternalIPv6) is disabled by default because CHECK_INTERNAL_IP defaults to false (not &#39;true&#39;), so these bypasses reach the metadata endpoint without any further validation. At time of publication, there are no publicly available patches.

Gravedad CVSS v3.1: ALTA

Última modificación:

12/05/2026

Suscribirse a Vulnerabilidades