Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-40187
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malicious eTemplate XML file (`.xet`) to the VFS `/etemplates` mount. The `Widget::expand_name()` method passes template widget attribute values directly into a PHP `eval()` call with only double-quote escaping applied - **backtick characters are not escaped**. In PHP, backticks inside a double-quoted `eval()` string execute shell commands. This allows an admin-level user to escalate from web application access to arbitrary OS command execution on the server.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/07/2026

CVE-2026-35590
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing data to libexif, leading to a possible null pointer dereference and crash. This has been patched in version 8.18.2.
Gravedad CVSS v4.0: MEDIA
Última modificación:
23/07/2026

CVE-2026-35591
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG or JPEG2000-encoded tile within a TIFF image, leading to a possible buffer overflow. This has been patched in version 8.18.2.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/07/2026

CVE-2026-39879
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured.<br /> <br /> Fixes are in syslog-ng 4.12, syslog-ng Premium Edition 8.2 and syslog-ng Store Box 7.8
Gravedad CVSS v3.1: ALTA
Última modificación:
23/07/2026

CVE-2026-32824
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply `forwardToUrl` and `redirectUrl` values when triggering password reset or confirmation flows. Those values are then embedded into the outgoing email workflow without host allowlisting. This creates two related abuse paths:<br /> - password reset or confirmation links can be sent to a victim with the token already attached to an attacker-controlled `forwardToUrl`<br /> - after a legitimate password reset completes, the browser is redirected to attacker-controlled `redirectUrl`<br /> <br /> In practice, this can be used for phishing, token capture, confirmation hijacking, or steering a victim from a trusted email<br /> into an attacker domain. This is patched in version 26.06.08.
Gravedad CVSS v3.1: ALTA
Última modificación:
21/07/2026

CVE-2026-32825
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise&amp;#39;s `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk:<br /> - valid user accounts can be attacked continuously without temporary lockout<br /> - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login`<br /> - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow<br /> - the API endpoint is especially attractive for automation because it requires no CSRF token<br /> <br /> This has been patched in version 26.06.08.
Gravedad CVSS v3.1: ALTA
Última modificación:
21/07/2026

CVE-2026-35048
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
21/07/2026

CVE-2026-35217
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length construction, the same parser flaw also causes a 1-byte out-of-bounds read that crosses the real heap allocation boundary and is detected by ASAN as a `heap-buffer-overflow`.<br /> <br /> If the consumed byte happens to look acceptable, NanoMQ may continue and append the malformed subscription entry into its internal `subinfol` state. In that case, a `SUBSCRIBE` packet that should be rejected by MQTT rules is instead treated as a successful subscription. Whether ASAN reports the bug does not depend on MQTT&amp;#39;s logical `remain` boundary; it depends on whether the read crosses the real heap allocation boundary of the underlying message buffer. In other words, these are not two unrelated issues. They are two manifestations of the same parsing defect: by default, it appears as a semantic vulnerability, and under suitable input conditions, it also becomes a verifiable out-of-bounds read vulnerability.
Gravedad CVSS v3.1: MEDIA
Última modificación:
23/07/2026

CVE-2026-33327
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/07/2026

CVE-2026-33328
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.
Gravedad CVSS v4.0: MEDIA
Última modificación:
23/07/2026

CVE-2026-16312
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Gravedad: Pendiente de análisis
Última modificación:
20/07/2026

CVE-2026-32806
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered and does not apply controller-specific authorization before rendering the selected view. This enables a low-privileged user to retrieve server-side rendered admin content that is otherwise hidden by navigation and route checks. On the test instance, a Standard user was able to retrieve the PostgreSQL admin dashboard stats even though /admin itself redirected away. This is patched in 26.06.08.
Gravedad CVSS v3.1: ALTA
Última modificación:
21/07/2026
Suscribirse a Vulnerabilidades