Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-15629

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A weakness has been identified in louisho5 picobot up to 0.2.0. Impacted is the function CreateSkill/GetSkill of the file internal/agent/tools/filesystem.go of the component Workspace Handler. Executing a manipulation can lead to link following. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: BAJA

Última modificación:

14/07/2026

CVE-2026-15628

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision._download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Performing a manipulation of the argument image results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.1.2 is capable of addressing this issue. The patch is named e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The affected component should be upgraded.

Gravedad CVSS v4.0: BAJA

Última modificación:

14/07/2026

CVE-2026-15627

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack may be performed from remote. The exploit is publicly available and might be used.

Gravedad CVSS v4.0: BAJA

Última modificación:

14/07/2026

CVE-2026-15626

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in nextlevelbuilder GoClaw 3.13.3-beta.3. This affects the function writeFile of the file internal/providers/acp/tool_bridge.go of the component ACP ToolBridge Workspace Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Gravedad CVSS v4.0: BAJA

Última modificación:

15/07/2026

CVE-2026-7640

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;type&#39; attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Gravedad CVSS v3.1: MEDIA

Última modificación:

15/07/2026

CVE-2026-15624

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability has been found in nextlevelbuilder GoClaw 3.13.3-beta.3. Affected by this vulnerability is the function bytePlusDownloadVideo of the file internal/tools/create_video_byteplus.go of the component invoke Endpoint. The manipulation of the argument output.video_url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Gravedad CVSS v4.0: BAJA

Última modificación:

15/07/2026

CVE-2026-15622

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument user_id can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 67fcc88505c57f77d3fcf04eb5b89425b10cbf48. Upgrading the affected component is recommended.

Gravedad CVSS v4.0: MEDIA

Última modificación:

14/07/2026

CVE-2026-15625

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. Affected by this issue is the function ExecApprovalManager.CheckCommand of the file internal/tools/exec_approval.go. The manipulation results in incomplete blacklist. The attack can be executed remotely. The exploit has been made public and could be used.

Gravedad CVSS v4.0: BAJA

Última modificación:

14/07/2026

CVE-2026-11802

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the &#39;customer&#39; role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.

Gravedad CVSS v3.1: MEDIA

Última modificación:

15/07/2026

CVE-2026-11390

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request in order to bypass the client-side SELECT control restrictions and submit arbitrary tag-name values.

Gravedad CVSS v3.1: MEDIA

Última modificación:

14/07/2026

CVE-2026-44761

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

15/07/2026

CVE-2026-44767

Fecha de publicación:

14/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL parameter.Exploitation requires attacker-influenced input (e.g., a URL query parameter, tenant configuration, or user-supplied setting) to reach setThemeRoot(). A successful exploit allows an attacker to inject arbitrary CSS into the victim page, enabling:- UI redressing and clickjacking- Phishing overlays- Visual defacement- Limited data exfiltration via CSS attribute selectors targeting predictable DOM content

Gravedad CVSS v3.1: MEDIA

Última modificación:

14/07/2026

Suscribirse a Vulnerabilidades