Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-107810

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/10/2026

CVE-2026-107811

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/10/2026

CVE-2026-107809

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator&#39;s browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim&#39;s session. This issue is fixed in version 2.5.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/10/2026

CVE-2026-107807

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/10/2026

CVE-2026-107808

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the password can take over the account and reach administrative functionality without the registered passkey. This issue is fixed in version 2.5.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/10/2026

CVE-2026-107812

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/10/2026

CVE-2026-107783

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user&#39;s cleartext AWS Management Console password from command output and log artifacts.<br /> <br /> <br /> <br /> To remediate this issue, users should upgrade to version 5.0.306 or later. After upgrading, review PowerShell transcripts and log stores for previously disclosed passwords and rotate any affected IAM console passwords.

Gravedad CVSS v4.0: MEDIA

Última modificación:

09/10/2026

CVE-2026-104084

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account&#39;s current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the time of demotion, can replay the stale token to obtain a new access token retaining the higher-privilege role (such as DomainAdmin or SysAdmin) until natural token expiry.

Gravedad CVSS v4.0: ALTA

Última modificación:

09/10/2026

CVE-2026-104082

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted Scripts directory via the domain-put endpoint. Attackers can disclose the Scripts path through the AddOrUpdateMount endpoint, clear the upload extension blacklist via the global-mail endpoint, then upload a malicious script through the ordinary mail file-storage upload API so that saving a CommandMount triggers RunScript before validation, resulting in a reverse shell executing as the SmarterMail service account with SYSTEM-level privileges.

Gravedad CVSS v4.0: ALTA

Última modificación:

09/10/2026

CVE-2026-104083

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content (), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an payload that executes automatically in the recipient&#39;s webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface&#39;s permissive Content-Security-Policy.

Gravedad CVSS v4.0: MEDIA

Última modificación:

09/10/2026

CVE-2026-102554

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.

Gravedad CVSS v4.0: ALTA

Última modificación:

09/10/2026

CVE-2026-95702

Fecha de publicación:

09/10/2026

Idioma:

Inglés

*** Pendiente de traducción *** Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.

Gravedad CVSS v4.0: ALTA

Última modificación:

09/10/2026

Suscribirse a Vulnerabilidades