Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-44182
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., duplicate securityContext keys, where the last one prevails), and inject document boundaries (--- for new documents, ... for end-of-document) to generate multiple resources, potentially creating arbitrary types, such as privileged pods. The Jinja2 template for the Kubernetes manifest contains several kernel_xxx variables, such as kernel_working_dir that are used when rendering the manifest and are all vectors for YAML injection. This issue has been fixed in version 3.3.0.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
17/07/2026

CVE-2026-43977
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats/ that are intended to return data for the requesting user's own training history within a routine. However, the underlying permission check (RoutinePermission.has_object_permission) grants read access to any authenticated user when the routine has is_template=True, regardless of ownership. When the /logs/ or /stats/ actions are invoked against a routine the attacker does not own, they return the owner's private workout history, not the attacker's. This issue has been fixed in version 2.6.
Gravedad CVSS v3.1: ALTA
Última modificación:
17/07/2026

CVE-2026-43978
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information. This issue has been fixed in version 2.6.
Gravedad CVSS v3.1: ALTA
Última modificación:
17/07/2026

CVE-2026-44433
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM frame carrying just one byte at the largest offset being permitted to obtain additional flow control credit, which under certain circumstances could lead to a Denial of Service. Assuming the application prepares a receive buffer for storing all data that arrive out-of-order, up to the largest offset being received, this behavior could lead to the application allocating large amount of memory with the peer sending only a handful of packets, resulting in memory exhaustion. In addition to the receive buffer allocation strategy, the severity of this vulnerability depends on how the application controls the stream concurrency. In case of the H2O HTTP server, under its default setting, this bug increases the maximum amount of memory allocated per connection by about 4 times. This issue has been fixed by commit 8b178e6.
Gravedad CVSS v3.1: MEDIA
Última modificación:
17/07/2026

CVE-2026-44434
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit dccf5d4, Quicly was vulnerable to stateless reset injection through lack of packet entry validation. The QUIC protocol is designed to withstand packet injection attacks, once the handshake is complete. Only packets that carry some secret patterns are considered as stateless resets. Quicly allows the peer to share up to 4 such patterns per connection. However, until now, it failed to determine which of the 4 slots that it uses to retain the secret patterns contains a valid entry. As the slots are zero-initialized, the failure meant that, unless the peer advertised 4 of such patterns, an all-zero pattern was treated as a stateless reset.In effect, this allowed an on-path attacker to reset QUIC connections governed by Quicly. This issue has been fixed by commit dccf5d4.
Gravedad CVSS v3.1: MEDIA
Última modificación:
18/07/2026

CVE-2026-11740
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Gravedad: Pendiente de análisis
Última modificación:
16/07/2026

CVE-2026-14253
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Gravedad: Pendiente de análisis
Última modificación:
16/07/2026

CVE-2026-15997
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers.<br /> <br /> This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C.<br /> <br /> <br /> <br /> This issue affects BC-LTS: from 2.73.0 before 2.73.12.1.<br /> <br /> <br /> <br /> Issue is only applicable if application involved is accepting memoable SHA3 / SHAKE states from potentially untrusted sources.
Gravedad CVSS v4.0: BAJA
Última modificación:
17/07/2026

CVE-2026-58643
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/07/2026

CVE-2026-59117
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.
Gravedad CVSS v3.1: ALTA
Última modificación:
22/07/2026

CVE-2026-62826
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Gravedad CVSS v3.1: MEDIA
Última modificación:
22/07/2026

CVE-2026-58598
Fecha de publicación:
16/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Concurrent execution using shared resource with improper synchronization (&amp;#39;race condition&amp;#39;) in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Gravedad CVSS v3.1: ALTA
Última modificación:
22/07/2026
Suscribirse a Vulnerabilidades