Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-71381
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** Adobe Genuine Software Integrity Service was affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could have leveraged this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue did not require user interaction, but required the attacker to have access to the local environment the application is installed on.
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/08/2026

CVE-2026-9030
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** A denial-of-service<br /> vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool<br /> instruction handlng path in httpd does not properly synchronize or safely manage<br /> concurrent systool operations.  <br /> <br /> <br /> <br /> <br /> <br /> By sending<br /> crafted systool instructions through the asynchronous request path, successful<br /> exploitation may cause the httpd process or device management service to crash<br /> and may result in temporary loss of access to the web management interface or<br /> device reboot.
Gravedad CVSS v4.0: MEDIA
Última modificación:
07/08/2026

CVE-2026-9031
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** An input validation<br /> vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation<br /> of user-supplied data before it is processed by internal flash-write handling<br /> logic.<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> Successful<br /> exploitation may cause httpd process or device to crash, resulting in loss of access<br /> to the web interface and a denial-of-service condition.
Gravedad CVSS v4.0: MEDIA
Última modificación:
07/08/2026

CVE-2026-54338
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/08/2026

CVE-2026-59717
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the destination hostname. Because no screen in the invitation or onboarding flow shows the parsed server URL before onboarding commits to it, a victim has no way to distinguish a legitimate invite from a malicious one. An attacker can craft an invite so that a single tap on the legitimate-looking "Connect to my Home Assistant server" button opens their /auth/authorize endpoint in the URL-less onboarding WebView, presenting a look-alike login page that captures the victim&amp;#39;s credentials. Since invitations are intended to onboard brand-new users, targets are especially unlikely to notice the substitution. This issue is fixed in version 2026.6.1.
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/08/2026

CVE-2026-66060
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.
Gravedad CVSS v3.1: ALTA
Última modificación:
07/08/2026

CVE-2026-66061
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.
Gravedad CVSS v3.1: ALTA
Última modificación:
07/08/2026

CVE-2026-69207
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.34, the built-in CORS middleware, hono/cors, is vulnerable to a regular expression denial of service (ReDoS). During a preflight OPTIONS request, the middleware parses the attacker-controlled Access-Control-Request-Headers header using a whitespace-tolerant regular expression whose backtracking makes its running time quadratic in the input length. Because the header value is bounded only by the deployment&amp;#39;s maximum HTTP header size, a single preflight carrying a long run of whitespace can consume seconds of CPU and block request processing. On runtimes that share one execution thread across requests, this stalls concurrent requests as well, and repeated requests can render the service unresponsive. This affects the default configuration, since the vulnerable path is reached whenever cors() is used with an unset or empty allowHeaders. Applications that set a non-empty allowHeaders are not affected. This issue is fixed in version 4.12.34.
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/08/2026

CVE-2026-46358
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao&amp;#39;s inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.
Gravedad CVSS v4.0: MEDIA
Última modificación:
07/08/2026

CVE-2026-47662
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling&amp;#39;s typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.
Gravedad CVSS v4.0: ALTA
Última modificación:
07/08/2026

CVE-2026-47663
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling&amp;#39;s typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.
Gravedad CVSS v4.0: ALTA
Última modificación:
07/08/2026

CVE-2026-47664
Fecha de publicación:
07/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the `$import-pnp` operation in Pathling Server accepts a caller-supplied `exportUrl` and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are configured, Pathling builds a credentialed bulk-export client targeting the caller-chosen host, downloads manifest-selected files, and then reclassifies those staged files as trusted local `file://` imports - bypassing the configured `allowableSources` allowlist that protects the ordinary `$import` operation. This is fixed in Pathling Server 2.0.0. As a workaround, disable the `$import-pnp` operation (`pathling.operations.importPnpEnabled=false`) or do not configure PNP credentials.
Gravedad CVSS v4.0: ALTA
Última modificación:
07/08/2026
Suscribirse a Vulnerabilidades