Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-65708
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController. Attackers can supply arbitrary numeric file IDs through the download, view, delete, upload, and list actions to enumerate and manipulate any attachment in the vault, bypassing account-level access controls entirely.
Gravedad CVSS v4.0: ALTA
Última modificación:
27/07/2026

CVE-2026-65709
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke AccountController methods such as viewAction, editAction, deleteAction, and editPassAction without AccountFilterUser checks to modify or delete accounts beyond the scope of their assigned token permissions.
Gravedad CVSS v4.0: ALTA
Última modificación:
27/07/2026

CVE-2026-65710
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINK_CREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the public link creation flow. Attackers can invoke the saveCreateFromAccountAction endpoint to cause AccountService::getDataForLink to load arbitrary target accounts without AccountFilterUser restrictions, decrypt credentials using the session master key, and serialize cleartext passwords into Vault storage on the PublicLink database row, enabling subsequent unauthenticated retrieval if the generated link hash is recovered.
Gravedad CVSS v4.0: ALTA
Última modificación:
27/07/2026

CVE-2026-65711
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or equivalent sanitization before passing it to exec(), causing injected commands to persist and execute on every subsequent backup trigger.
Gravedad CVSS v4.0: ALTA
Última modificación:
27/07/2026

CVE-2026-65707
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.
Gravedad CVSS v4.0: ALTA
Última modificación:
28/07/2026

CVE-2026-65623
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly.<br /> <br /> The size guard &amp;#39;Elixir.Bandit.WebSocket.Connection&amp;#39;:oversize_message?/2 called from handle_frame/3 in lib/bandit/websocket/connection.ex appends each non-final continuation frame to a left-nested iolist and then re-measures the entire accumulated buffer with IO.iodata_length/1 on every frame. Because the buffer grows by one element per frame and is fully re-traversed each time, reassembly work is quadratic (O(n^2)) in the number of continuation frames.<br /> <br /> The max_fragmented_message_size limit (default 8 MB) bounds total bytes but not frame count, and each frame can carry as little as one payload byte, so an attacker can send millions of tiny continuation frames using modest bandwidth to pin a CPU core for minutes to hours. Many concurrent connections can starve the whole server of CPU, denying service to legitimate users. The WebSocket read timeout does not help, because it is an idle timeout evaluated between reads and cannot preempt the synchronous reassembly work spent inside a single callback.<br /> <br /> This issue affects bandit: from 1.11.0 before 1.12.1.
Gravedad CVSS v4.0: ALTA
Última modificación:
30/07/2026

CVE-2026-65693
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated administrators to achieve arbitrary OS command execution by injecting Twig expressions into mail templates. Attackers can exploit the unsandboxed Twig environment in TwigView::render(), which lacks SandboxExtension or a SecurityPolicy, to inject malicious expressions such as filter(&amp;#39;system&amp;#39;) into mail template bodies stored unsanitized in the database, causing automatic payload execution on each subsequent application event that triggers a mail dispatch.
Gravedad CVSS v4.0: ALTA
Última modificación:
28/07/2026

CVE-2026-64253
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> kernel/fork: clear PF_BLOCK_TS in copy_process()<br /> <br /> PF_BLOCK_TS is only set in blk_time_get_ns() when current-&gt;plug is<br /> non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()<br /> before NULLing the plug pointer. copy_process() breaks the<br /> invariant by inheriting PF_BLOCK_TS from the parent while resetting<br /> the child&amp;#39;s plug to NULL.<br /> <br /> Clear PF_BLOCK_TS alongside that assignment so callers can rely on<br /> "PF_BLOCK_TS set implies current-&gt;plug != NULL" and dereference<br /> current-&gt;plug unguarded.
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026

CVE-2026-64254
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR<br /> <br /> When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown<br /> path ends up calling pci_iounmap() on the same iomem with some offset,<br /> which is unnecessary and triggers a kernel warning like the following:<br /> <br /> Trying to vunmap() nonexistent vm area (0000000069a5ffe8)<br /> WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937<br /> [...]<br /> Call trace:<br /> vunmap+0x58/0x68 (P)<br /> iounmap+0x34/0x48<br /> pci_iounmap+0x2c/0x40<br /> ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]<br /> pci_device_remove+0x48/0xf8<br /> device_remove+0x50/0x88<br /> device_release_driver_internal+0x1c8/0x228<br /> driver_detach+0x50/0xb0<br /> bus_remove_driver+0x74/0x100<br /> driver_unregister+0x34/0x68<br /> pci_unregister_driver+0x34/0xa0<br /> ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]<br /> [...]<br /> <br /> Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026

CVE-2026-64255
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers<br /> <br /> Three BA session handlers use ffs(ba_data-&gt;sta_mask) - 1 to derive a<br /> station ID without checking that sta_mask is non-zero. When sta_mask is<br /> zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing<br /> an out-of-bounds access on fw_id_to_link_sta[].<br /> <br /> Add WARN_ON_ONCE(!ba_data-&gt;sta_mask) guards before each ffs() call,<br /> consistent with the existing check in iwl_mld_ampdu_rx_start().
Gravedad CVSS v3.1: ALTA
Última modificación:
30/07/2026

CVE-2026-66027
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user&amp;#39;s session queue, causing the background drainer to forward malicious messages to the victim&amp;#39;s running AI agent with the victim&amp;#39;s credentials and permissions.
Gravedad CVSS v4.0: ALTA
Última modificación:
30/07/2026

CVE-2026-64246
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init()<br /> <br /> Move of_node_put(dn) after the of_match_node() call, which still needs<br /> the node pointer. The node reference is correctly released after use.
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026
Suscribirse a Vulnerabilidades