Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-47375

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT(...). The value is unrestricted by formula validation and embedded into a knex.raw ORDER BY clause, executing during column creation and on every subsequent record read of the formula column. The vulnerability is specific to the Postgres mapping for ARRAYSORT in packages/nocodb/src/db/functionMappings/pg.ts. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-47376

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47377

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.replace() on a path extracted from the URL hash fragment after only checking hashPath.startsWith(&#39;/&#39;). Protocol-relative URLs (//attacker.com/…) also satisfy that check, so a crafted link silently redirected visitors to an attacker-controlled origin. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47378

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47379

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for legacy plaintext passwords, leaking the password&#39;s length and per-character prefix through response timing. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47380

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47381

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace&#39;s integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller&#39;s permission check matched any base in any workspace. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-46548

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notification webhook plugins (Slack, Discord, Mattermost, Teams) because httpAgent / httpsAgent were passed as part of the request body rather than the axios config. An authenticated user with hook-creation permission could direct outbound POST requests to arbitrary internal hosts. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-46549

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope (e.g. MCP-only) therefore inherited the full permissions of the underlying user across all routes; the granted_resources.base_id restriction was bypassed on org-level endpoints that don&#39;t populate req.context.base_id. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: BAJA

Última modificación:

25/06/2026

CVE-2026-46550

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with httpOnly: true but missing both the secure flag and the sameSite attribute. Over plain HTTP the cookie could be intercepted on the network; without sameSite, browsers attached it to cross-site POSTs, enabling CSRF against the token-refresh endpoint. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-46551

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service. In packages/nocodb/src/services/attachments.service.ts, the HEAD probe read content-length but never compared it to NC_ATTACHMENT_FIELD_SIZE; the subsequent storageAdapter.fileCreateByUrl() performed the download without maxContentLength. This vulnerability is fixed in 2026.04.4.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-46552

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, shared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only the shared-base UUID (xc-shared-base-id), an attacker could enumerate base members and invite an arbitrary email into the base as a real member. The invited user could then redeem the invite via the normal signup flow and retain authenticated access even after the owner revoked the shared link. Shared-base sessions were mapped to ProjectRoles.VIEWER in packages/nocodb/src/strategies/base-view.strategy/base-view.strategy.ts, and packages/nocodb/src/utils/acl.ts granted baseUserList and userInvite to that role. The shared frontend (packages/nc-gui/composables/useApi/interceptors.ts) deliberately removed auth headers in favour of the shared-base header, but the ACL middleware did not distinguish shared sessions from genuine viewers. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

Suscribirse a Vulnerabilidades