Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-49370

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

Gravedad CVSS v3.1: BAJA

Última modificación:

29/05/2026

CVE-2026-49371

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible

Gravedad CVSS v3.1: ALTA

Última modificación:

29/05/2026

CVE-2026-47744

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

29/05/2026

CVE-2026-47745

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/05/2026

CVE-2026-46344

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a correctly-sized signature buffer for the declared algorithm but a public key whose OID bytes (pk[0..3]) reference a different XMSS parameter set with a larger sig_bytes, the implementation re-parses the OID from the public key inside xmss_sign_open / xmssmt_sign_open and uses the resulting (larger) sig_bytes to index the caller-supplied signature buffer. As with CVE-2026-44518, the out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/05/2026

CVE-2026-44652

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, corsProxyMiddleware forwards req.params.url directly into fetch(url, ...). It only blocks circular requests to its own host and does not enforce destination allowlist or private/loopback restrictions, enabling SSRF. This vulnerability is fixed in 1.18.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

29/05/2026

CVE-2026-46372

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern exposes /api/search/searxng, which accepts attacker-controlled baseUrl and uses it directly to build outbound server-side fetches. An authenticated low-privilege user can point baseUrl at an internal or loopback HTTP service and receive the /search response body. This vulnerability is fixed in 1.18.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

29/05/2026

CVE-2026-47740

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

29/05/2026

CVE-2026-47741

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount&#39;s total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/05/2026

CVE-2026-47742

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product&#39;s pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/05/2026

CVE-2026-42951

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** An authenticated<br /> user can download a backup of the Danelec MacGregor Voyage Data Recorder<br /> <br /> <br /> device which includes account data and password hashes.

Gravedad CVSS v4.0: MEDIA

Última modificación:

29/05/2026

CVE-2026-44518

Fecha de publicación:

29/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification function is called with a signature buffer shorter than the expected signature size for the given parameter set, the implementation does not validate the caller-supplied length and proceeds to read past the end of the buffer. The out-of-bounds bytes are consumed only as input to an internal hash computation and are not returned to the caller, so no oracle exists to leak their contents to an attacker. The primary observable effect is a possible crash (denial of service) of the verifying process if the read crosses into an unmapped memory page. This vulnerability is fixed in 0.16.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

29/05/2026

Suscribirse a Vulnerabilidades