Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-63088
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist by exploiting incomplete address validation in the url_is_blacklisted function, which inspects only the first resolved address while the underlying HTTP client iterates all cached addresses.
Gravedad CVSS v4.0: ALTA
Última modificación:
16/07/2026

CVE-2026-6511
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the same system.
Gravedad CVSS v4.0: MEDIA
Última modificación:
16/07/2026

CVE-2026-57073
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.<br /> <br /> The parserc_parse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer.<br /> <br /> Truncated strings such as "
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
17/07/2026

CVE-2026-63087
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization&amp;#39;s grafana_url and api_token.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
17/07/2026

CVE-2026-57074
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** XML::Bare versions through 0.53 for Perl have an unbounded character lookahead.<br /> <br /> The parserc_parse function attempts to check for multicharacter strings such as "" without checking that the offsets are within the buffer.<br /> <br /> Truncated strings such as "
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
17/07/2026

CVE-2026-63085
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such as roles and group by submitting changes through a related entity&amp;#39;s save path, bypassing the USER_RESTRICTED_FIELDS control and causing the JPA persistence layer to flush attacker-supplied admin role and group assignments on commit.
Gravedad CVSS v4.0: ALTA
Última modificación:
17/07/2026

CVE-2026-55406
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &amp;&amp;#39;static [u8], and the Deref implementation exposed the promoted &amp;#39;static lifetime on borrowed view fields (such as &amp;&amp;#39;static str and &amp;&amp;#39;static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, the references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse without any unsafe code in the calling application. This issue is fixed in version 0.7.0.
Gravedad CVSS v4.0: MEDIA
Última modificación:
16/07/2026

CVE-2026-55407
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa&amp;#39;s protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget, affecting any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default); a small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22x memory amplification (for example a 64 MiB input forcing about 1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, so an unauthenticated attacker could crash a process through memory exhaustion because the top-level message size cap did not account for in-decode amplification. This issue is fixed in version 0.8.0.
Gravedad CVSS v4.0: MEDIA
Última modificación:
16/07/2026

CVE-2026-47751
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionally enabled all project MCP servers via enableAllProjectMcpServers, an attacker who opened a pull request containing a malicious .mcp.json file could achieve arbitrary code execution on the GitHub Actions runner and exfiltrate secrets available to the workflow (such as API keys and tokens) when a privileged user or an automatic trigger invoked the Claude action on the pull request. This issue is fixed in version 1.0.74, which restores .claude/ and .mcp.json from the pull request base branch before the CLI runs.
Gravedad CVSS v4.0: MEDIA
Última modificación:
18/07/2026

CVE-2026-55548
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.
Gravedad CVSS v3.1: MEDIA
Última modificación:
20/07/2026

CVE-2026-50012
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest&amp;#39;s on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.
Gravedad CVSS v3.1: MEDIA
Última modificación:
20/07/2026

CVE-2026-47729
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid&amp;#39;s gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.
Gravedad CVSS v3.1: MEDIA
Última modificación:
20/07/2026
Suscribirse a Vulnerabilidades