Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-50193

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This can consume significant amount of resources with concurrent relatively small requests (1000 nested arrays is 2kB). This vulnerability is fixed in 2.14.0.

Gravedad CVSS v4.0: MEDIA

Última modificación:

27/06/2026

CVE-2026-47382

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47383

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. The comment write paths persisted the raw comment body with no server-side sanitisation; the expanded-form sidebar then rendered the stored body and fed its data-tooltip attribute to Tippy with allowHTML: true. Even when the editor stripped script tags at write time, attribute-level payloads re-entered the DOM as live HTML on hover. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: ALTA

Última modificación:

25/06/2026

CVE-2026-47384

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk groupBy endpoint by setting a column&#39;s title to a SQL fragment. The bulk groupBy path in group-by.ts builds three database-specific knex.raw() aggregations that interpolate the request&#39;s column_name directly into the SQL string. Column lookup in data-table.service.ts matches on both the sanitized column_name field and the free-text title, so a title containing a SQL fragment bypasses the public endpoint&#39;s existing column allowlist and reaches the query builder unescaped. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47385

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file on the NocoDB host, including NocoDB&#39;s own internal databases. The SQLite client and the base/integration create services accepted a caller-supplied filename and passed it to fs.exists and fs.open(&#39;w&#39;) without restricting the location. A user could point a source at noco.db, at a tenant database under nc_minimal_dbs/, or at any writable path the NocoDB process can reach, and then read or overwrite its contents through the regular table APIs.This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47386

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-exchange requests using the same OAuth authorization code could each mint a distinct valid (access_token, refresh_token) pair, breaking the single-use guarantee that PKCE relies on. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47387

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler (packages/nc-gui/composables/useSharedFormViewStore.ts) in NocoDB writes the form&#39;s redirect_url to window.location.href after a same-host check that does not validate the URL scheme. A user with editor role (or above) on any base can plant a javascript: URL in the form&#39;s redirect_url; when an authenticated viewer opens the share-link and submits the form, the payload executes in the NocoDB origin and can read the session token from localStorage["nocodb-gui-v2"]. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: ALTA

Última modificación:

25/06/2026

CVE-2026-47388

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read any file in shared storage, including attachments belonging to other bases and workspaces, because the MCP readAttachment tool did not verify the file&#39;s ownership. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: BAJA

Última modificación:

25/06/2026

CVE-2026-47375

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can inject arbitrary SQL into the formula engine via the optional direction argument of ARRAYSORT(...). The value is unrestricted by formula validation and embedded into a knex.raw ORDER BY clause, executing during column creation and on every subsequent record read of the formula column. The vulnerability is specific to the Postgres mapping for ARRAYSORT in packages/nocodb/src/db/functionMappings/pg.ts. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-47376

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or backslashes, so a crafted token could break out of the JS string context and execute attacker-controlled script in the NocoDB origin. Triggering required only that a victim follow a malicious password-reset link. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47377

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.replace() on a path extracted from the URL hash fragment after only checking hashPath.startsWith(&#39;/&#39;). Protocol-relative URLs (//attacker.com/…) also satisfy that check, so a crafted link silently redirected visitors to an attacker-controlled origin. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47378

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had hidden, via three independent paths: groupBy returned raw values for any column named in the request, filter and sort arrays operated on hidden columns enabling boolean-blind extraction, and the related-data list accepted arbitrary link-column IDs from other tables in the same base. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

Suscribirse a Vulnerabilidades