Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-47379

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view password check fell back to strict-equality (===) comparison for legacy plaintext passwords, leaking the password&#39;s length and per-character prefix through response timing. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47380

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-47381

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace&#39;s integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller&#39;s permission check matched any base in any workspace. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-46548

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notification webhook plugins (Slack, Discord, Mattermost, Teams) because httpAgent / httpsAgent were passed as part of the request body rather than the axios config. An authenticated user with hook-creation permission could direct outbound POST requests to arbitrary internal hosts. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-46549

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strategy attached oauth_scope and oauth_granted_resources to the request user, but the ACL middleware never consulted either. An OAuth token issued with a restricted scope (e.g. MCP-only) therefore inherited the full permissions of the underlying user across all routes; the granted_resources.base_id restriction was bypassed on org-level endpoints that don&#39;t populate req.context.base_id. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: BAJA

Última modificación:

25/06/2026

CVE-2026-46550

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with httpOnly: true but missing both the secure flag and the sameSite attribute. Over plain HTTP the cookie could be intercepted on the network; without sameSite, browsers attached it to cross-site POSTs, enabling CSRF against the token-refresh endpoint. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-46551

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NC_ATTACHMENT_FIELD_SIZE against the remote content-length or against the response stream. An authenticated user (Editor+) could direct the server to download arbitrarily large files, exhausting disk space and causing denial of service. In packages/nocodb/src/services/attachments.service.ts, the HEAD probe read content-length but never compared it to NC_ATTACHMENT_FIELD_SIZE; the subsequent storageAdapter.fileCreateByUrl() performed the download without maxContentLength. This vulnerability is fixed in 2026.04.4.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-46552

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, shared-base sessions were granted the same base-member capabilities as authenticated viewers. Using only the shared-base UUID (xc-shared-base-id), an attacker could enumerate base members and invite an arbitrary email into the base as a real member. The invited user could then redeem the invite via the normal signup flow and retain authenticated access even after the owner revoked the shared link. Shared-base sessions were mapped to ProjectRoles.VIEWER in packages/nocodb/src/strategies/base-view.strategy/base-view.strategy.ts, and packages/nocodb/src/utils/acl.ts granted baseUserList and userInvite to that role. The shared frontend (packages/nc-gui/composables/useApi/interceptors.ts) deliberately removed auth headers in favour of the shared-base header, but the ACL middleware did not distinguish shared sessions from genuine viewers. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

CVE-2026-46553

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL path did not enforce NC_ATTACHMENT_FIELD_SIZE against either the remote file&#39;s advertised Content-Length or the decoded length of a data: URI, allowing an authenticated user to bypass the configured per-file size limit. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v4.0: BAJA

Última modificación:

25/06/2026

CVE-2026-46554

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cache was not invalidated by token value at deletion time. The API token deletion path removed the database row but did not evict the token-value keyed entry from the auth cache. The auth middleware therefore continued to accept the deleted token until the cache entry aged out, leaving a deletion-to-revocation window of up to three days. This vulnerability is fixed in 2026.04.4.

Gravedad CVSS v4.0: BAJA

Última modificación:

25/06/2026

CVE-2026-47279

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-view relation endpoints accepted a caller-supplied column ID without verifying that the column was visible in the shared view, so anyone holding a share UUID could read links from any LTAR column on the view&#39;s table — including columns the view owner had hidden. publicMmList, publicHmList, and relDataList already ensured that the requested column belonged to the view&#39;s model, but did not check the view-column entry&#39;s show flag. This vulnerability is fixed in 2026.05.1.

Gravedad CVSS v4.0: MEDIA

Última modificación:

25/06/2026

CVE-2026-46547

Fecha de publicación:

23/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, a reflected XSS vulnerability exists in the Page Leaving Warning page. The ncRedirectUrl and ncBackUrl query parameters are used in window.location.href and tag bindings without validation, allowing javascript: URI injection. This vulnerability is fixed in 2026.04.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

25/06/2026

Suscribirse a Vulnerabilidades