Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-53926

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensByUser in the users service is an empty stub being called from passwordChange, passwordForgot, and passwordReset. OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password, leaving an attacker-issued OAuth grant valid after the user believed they had locked the attacker out. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-53927

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path contained a permitted extension anywhere in the string, and applied a hand-rolled regex blocklist that omitted 127.0.0.0/8 and 169.254.0.0/16, allowing the cloud-metadata endpoint to be reached with a crafted URL This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-53928

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh token survived a password-forgot flow and could be used to mint fresh JWTs even after the user reset their password. passwordChange and passwordReset deleted the user&#39;s refresh tokens, but passwordForgot only rotated token_version and revoked OAuth tokens — it did not call UserRefreshToken.deleteAllUserToken(user.id). An attacker holding a captured refresh cookie could still exchange it for a new access token after the victim triggered the recovery flow. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-53930

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (file:, ftp:, etc.) and probing of internal HTTP destinations. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-53931

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the fix it was reachable unauthenticated, and its URL-extension allowlist was a regex tested against the full URL string, so URLs whose query string ended in .csv satisfies the gate even though the<br /> underlying request is for another file. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-50193

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

27/06/2026

CVE-2026-47382

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47383

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The comment write paths persisted the raw comment body with no server-side sanitisation; the expanded-form sidebar then rendered the stored body and fed its data-tooltip attribute to Tippy with allowHTML: true. Even when the editor stripped script tags at write time, attribute-level payloads re-entered the DOM as live HTML on hover. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: ALTA

Última modificación:

25/06/2026

CVE-2026-47384

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column&#39;s title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific knex.raw() aggregations that interpolate the request&#39;s column_name directly into the SQL string. Column lookup in data-table.service.ts matches on both the sanitized column_name field and the free-text title, so a title containing a SQL fragment bypasses the public endpoint&#39;s existing column allowlist and reaches the query builder unescaped. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47385

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB&#39;s own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open(&#39;w&#39;) without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47386

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47387

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form&#39;s redirect_url to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role (or above) on any base can plant a javascript: URL in the form&#39;s redirect_url; when an authenticated viewer opens the share-link and submits the form, the payload executes in the NocoDB origin and can read the session token from localStorage["nocodb-gui-v2"]. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: ALTA

Última modificación:

25/06/2026

Suscribirse a Vulnerabilidades