Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-12687

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group&#39;s configured role, up to Administrator when such a group exists, leading to privilege escalation.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/07/2026

CVE-2026-11782

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Points and Rewards for WooCommerce WordPress plugin before 2.10.1 does not have authorisation checks in place on a wallet and points update action that is available to unauthenticated users, and does not verify that the requester owns the account being changed, allowing unauthenticated attackers to arbitrarily modify or corrupt (including driving it negative) the stored wallet balance and loyalty points of any user. Modifying the wallet balance additionally requires the companion Wallet System for WooCommerce Points and Rewards for WooCommerce WordPress plugin before 2.10.1 to be active.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/07/2026

CVE-2026-11867

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers) to create, rename, and delete arbitrary taxonomy terms.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/07/2026

CVE-2026-13143

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/07/2026

CVE-2026-13145

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer&#39;s booking details, including billing address information, by supplying an arbitrary booking identifier.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/07/2026

CVE-2026-11870

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05 does not verify that client IP information comes from a trusted proxy before trusting attacker-controllable HTTP headers, allowing unauthenticated attackers to spoof their IP address to bypass the WP Ghost (Hide My WP Ghost) WordPress plugin before 7.0.05&#39;s own brute-force protection and to downgrade its firewall by matching a hardcoded whitelisted IP range.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/07/2026

CVE-2026-12500

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

Gravedad CVSS v3.1: ALTA

Última modificación:

30/07/2026

CVE-2026-67248

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial of service of the affected CGI process. Further impact may be possible depending on exploitability and runtime protections.<br /> Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

Gravedad CVSS v4.0: ALTA

Última modificación:

04/08/2026

CVE-2026-67247

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause the affected component to access an unintended filesystem path or log database file.<br /> Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

Gravedad CVSS v4.0: ALTA

Última modificación:

04/08/2026

CVE-2026-67246

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside the intended wallpaper directory, subject to user permissions and filesystem restrictions.<br /> Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

Gravedad CVSS v4.0: MEDIA

Última modificación:

04/08/2026

CVE-2026-67245

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path. An authenticated attacker can exploit this issue to write an uploaded certificate file outside the intended VPN certificate directory, subject to process privileges and filesystem permissions.<br /> Affected products and versions include: from ADM 4.1.0 through ADM 4.3.3.RUN1 as well as from ADM 5.0.0 through ADM 5.1.3.RI81.

Gravedad CVSS v4.0: ALTA

Última modificación:

04/08/2026

CVE-2026-1360

Fecha de publicación:

30/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary PHP objects via XProfile textbox fields, which could lead to remote code execution if a suitable POP chain is available in the WordPress environment.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/07/2026

Suscribirse a Vulnerabilidades