Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-42180

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/post. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled link target. The submitted URL is checked for syntax and scheme, but the audited code path does not reject loopback, private, or link-local destinations before the Webmention request is issued. This lets a normal user trigger server-side HTTP requests toward internal services. This issue has been patched in version 0.19.18.

Gravedad CVSS v3.1: MEDIA

Última modificación:

12/05/2026

CVE-2026-42181

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.

Gravedad CVSS v3.1: MEDIA

Última modificación:

12/05/2026

CVE-2026-41495

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of: bearer tokens from the Authorization header, per-tenant API keys from the, x-n8n-key header in multi-tenant setups, JSON-RPC request payloads sent to the MCP endpoint. Access control itself was not bypassed — unauthenticated requests were correctly rejected with 401 Unauthorized — but sensitive values from those rejected requests could still be persisted in logs. This issue has been patched in version 2.47.11.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/05/2026

CVE-2026-42160

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered "PENDING" organization / user accounts. This issue has been patched in version 7.3.2.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

11/05/2026

CVE-2026-42176

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.67.0, Scoold allows the admins configuration value to be modified through /api/config/set/admins with a forged Bearer token that is accepted as an admin API token. Once that setting is changed, the target email address is written to the application configuration file. The change does not become active immediately in the current process, because the ADMINS set is loaded once at startup. After a Scoold restart, though, the selected user is recognized as an administrator and gains access to the admin panel. This issue gives an attacker a reliable persistence path: write their own email into scoold.admins, wait for a restart or trigger one operationally, and the account comes back as admin. This issue has been patched in version 1.67.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

12/05/2026

CVE-2026-41511

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file with a cycle in the LeftSiblingID / RightSiblingID chain causes Storage.EnumerateEntries() and Storage.OpenStream() to loop indefinitely, consuming the calling thread with no possibility of recovery via try/catch. This issue has been patched in version 3.1.3.

Gravedad CVSS v3.1: MEDIA

Última modificación:

11/05/2026

CVE-2026-8178

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application&#39;s classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

12/05/2026

CVE-2026-29202

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account&#39;s system user.

Gravedad CVSS v4.0: MEDIA

Última modificación:

11/05/2026

CVE-2026-29203

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** A chmod call in the cPanel Nova plugin&#39;s Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/05/2026

CVE-2026-29201

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` AdminBin call can cause arbitrary file read when a relative file path is passed.

Gravedad CVSS v3.1: MEDIA

Última modificación:

11/05/2026

CVE-2026-6659

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and unsuitable for cryptography.

Gravedad CVSS v3.1: ALTA

Última modificación:

12/05/2026

CVE-2026-41889

Fecha de publicación:

08/05/2026

Idioma:

Inglés

*** Pendiente de traducción *** pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

Gravedad CVSS v4.0: BAJA

Última modificación:

08/05/2026

Suscribirse a Vulnerabilidades