Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-6960

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the &#39;bookingpress_validate_submitted_booking_form_func&#39; function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site&#39;s server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

21/05/2026

CVE-2026-7879

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading<br /> permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file&#39;s password can download a password protected file regardless of whether they have permission to access the file. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Youssef Eid for reporting

Gravedad CVSS v4.0: MEDIA

Última modificación:

21/05/2026

CVE-2026-7881

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter. This IDOR leads to unauthorized access to all Express form submissions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Tristan Madani for reporting.

Gravedad CVSS v4.0: MEDIA

Última modificación:

21/05/2026

CVE-2026-5091

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.<br /> <br /> These versions use Perl&#39;s built-in eq comparison. Discrepencies in timing could be used to guess the underlying hash or password.

Gravedad: Pendiente de análisis

Última modificación:

22/05/2026

CVE-2026-22678

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low-privileged authenticated attackers to execute arbitrary commands by injecting unsanitized input stored in save_tmpl.cgi and rendered unescaped in list_tmpls.cgi.

Gravedad CVSS v4.0: MEDIA

Última modificación:

21/05/2026

CVE-2026-8421

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php. An attacker who can cause an authenticated administrator to visit a crafted page, and who has placed or caused a package to be present under DIR_PACKAGES//, can force the installation of that package without any CSRF protection. Package installation executes the package controller&#39;s install() method as the web server user, enabling remote code execution. In order to be vulnerable, the victim must be passing canInstallPackages. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/05/2026

CVE-2026-8426

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force its upgrade() method to execute in a single browser navigation. This results in remote code execution as the web server user. In order to be vulnerable, the victim must be passing canInstallPackages, victim site must be connected to the Concrete marketplace; and the attacker controls the package returned for a marketplace item ID already installed on the victim site. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/05/2026

CVE-2026-8428

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output(&#39;do_update&#39;)) but the corresponding do_update() method in concrete/controllers/single_page/dashboard/system/update/update.php never calls $this->token->validate(&#39;do_update&#39;). The form is rendered as a POST form, meaning the token reaches the browser, but because the controller discards it without verification, an attacker can craft a cross-site POST that triggers a core CMS update to an attacker-specified version string. In order to be vulnerable, theictim must be passing canUpgrade()anda valid update version must be present under DIR_CORE_UPDATES. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/05/2026

CVE-2026-8140

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/. The download() method in concrete/controllers/single_page/dashboard/extend/install.php checks only the canInstallPackages() permission before fetching a remote marketplace package and writing it to the server&#39;s DIR_PACKAGES directory. Because the endpoint is a state-changing GET route with no token enforcement, an attacker who can cause an authenticated administrator to visit a crafted page can force an arbitrary marketplace package to be downloaded. In order to be vulnerable, the victim must be passing canInstallPackages() and the site must be connected to the Concrete marketplace. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.5 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks https://github.com/maru1009 for reporting.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/05/2026

CVE-2026-8197

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name (admin-controlled) through Concrete&#39;s t() translation helper as a sprintf-style format. The ... wrap is built by PHP string interpolation before t() runs, so the integration name lands in the translated output as raw HTML. A rogue admin could potentially snoop on login submissions.The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Thanks Yonatan Drori (Tenzai) for reporting.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/05/2026

CVE-2026-8203

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS 9.5.0 and below has Stored XSS on the height parameter. The controller does not validate or sanitize $height. Any user with editor privileges can inject malicious JavaScript that executes in the context of any visitor&#39;s browser, potentially leading to session hijacking, credential theft, or other malicious actions. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Alfin Joseph for reporting.

Gravedad CVSS v4.0: ALTA

Última modificación:

21/05/2026

CVE-2026-8204

Fecha de publicación:

21/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure. A public calendar block can be used as a pivot point to access private calendar data. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting.

Gravedad CVSS v4.0: MEDIA

Última modificación:

21/05/2026

Suscribirse a Vulnerabilidades