Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-32825
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise&amp;#39;s `:lockable` module on the user model but explicitly disables both lock and unlock strategies, and no request throttling or rate-limiting layer was identified in the Rails code. This creates a direct online password-guessing risk:<br /> - valid user accounts can be attacked continuously without temporary lockout<br /> - the same weakness is reachable through both `/users/sign_in` and `/api/v4/auth/login`<br /> - successful guessing yields a normal session cookie in the HTML flow or a fresh JWT in the API flow<br /> - the API endpoint is especially attractive for automation because it requires no CSRF token<br /> <br /> This has been patched in version 26.06.08.
Gravedad CVSS v3.1: ALTA
Última modificación:
21/07/2026

CVE-2026-35048
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An unauthenticated attacker can inject arbitrary PHP code through POST parameters (prefix, dbpasswd, dbhost, dbname, or dbuser), which gets written to `local/config/database.inc.php` and executed on every page load.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
21/07/2026

CVE-2026-35217
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** NanoMQ contains a protocol-semantics flaw in its MQTT v5 `SUBSCRIBE` handling: if a subscription entry is missing the final 1-byte `Subscription Options` field, the broker may still accept the malformed packet and install the subscription into internal broker state. Under a specific packet-length construction, the same parser flaw also causes a 1-byte out-of-bounds read that crosses the real heap allocation boundary and is detected by ASAN as a `heap-buffer-overflow`.<br /> <br /> If the consumed byte happens to look acceptable, NanoMQ may continue and append the malformed subscription entry into its internal `subinfol` state. In that case, a `SUBSCRIBE` packet that should be rejected by MQTT rules is instead treated as a successful subscription. Whether ASAN reports the bug does not depend on MQTT&amp;#39;s logical `remain` boundary; it depends on whether the read crosses the real heap allocation boundary of the underlying message buffer. In other words, these are not two unrelated issues. They are two manifestations of the same parsing defect: by default, it appears as a semantic vulnerability, and under suitable input conditions, it also becomes a verifiable out-of-bounds read vulnerability.
Gravedad CVSS v3.1: MEDIA
Última modificación:
23/07/2026

CVE-2026-33327
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer overflow and a subsequent heap-based buffer overflow. This has been patched in version 8.18.1.
Gravedad CVSS v4.0: ALTA
Última modificación:
23/07/2026

CVE-2026-33328
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1.
Gravedad CVSS v4.0: MEDIA
Última modificación:
23/07/2026

CVE-2026-16312
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Gravedad: Pendiente de análisis
Última modificación:
20/07/2026

CVE-2026-32806
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered and does not apply controller-specific authorization before rendering the selected view. This enables a low-privileged user to retrieve server-side rendered admin content that is otherwise hidden by navigation and route checks. On the test instance, a Standard user was able to retrieve the PostgreSQL admin dashboard stats even though /admin itself redirected away. This is patched in 26.06.08.
Gravedad CVSS v3.1: ALTA
Última modificación:
21/07/2026

CVE-2026-32819
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users&amp;#39; names and email addresses through `/users/search`, even though direct access to those user profiles is denied. This leaks internal staff addresses, full names, and existence of guest and external test accounts.
Gravedad CVSS v3.1: MEDIA
Última modificación:
21/07/2026

CVE-2026-32820
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the documentation and static markdown renderer accepts attacker-controlled path segments and only runs them through the Rails HTML sanitizer, which does not remove directory traversal sequences. An unauthenticated attacker can traverse out of the intended `docs` or `static` directories and render arbitrary `.md` files from the application root or engine root. This is patched in version 26.06.08.
Gravedad CVSS v3.1: ALTA
Última modificación:
21/07/2026

CVE-2026-32821
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the collection API to evaluate permissions as a different user by supplying `user_email`. If the target user has collections, this can expose those collections through the API. In V4, once a collection id is known, the same controller also offers `add_item` and `remove_item` routes without any object-level `authorize!` checks,<br /> creating a likely cross-user modification path. This is patched in version 26.06.08.
Gravedad CVSS v3.1: ALTA
Última modificación:
21/07/2026

CVE-2026-32823
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application exposes server-side state changes through `GET` routes. Because browsers automatically send cookies on same-site top-level navigation and Rails does not apply CSRF protections to `GET`, an attacker can force a logged-in victim to modify application state by embedding a link, image, iframe, or redirect to one of these endpoints. This was confirmed on the target with a normal `Standard` account: a cross-site-style `GET` to `watch_lists/:id/add_item?thing_id=...` inserted content into a watch list with no CSRF token. Additional `GET` mutation routes exist in the codebase, including user impersonation for authorized admins and cache or<br /> translation state changes. This is patched in version 26.06.08.
Gravedad CVSS v3.1: MEDIA
Última modificación:
21/07/2026

CVE-2026-6793
Fecha de publicación:
20/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** Improper neutralization of input during web page generation (&amp;#39;cross-site scripting&amp;#39;) vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS.<br /> <br /> This issue affects Q-smart NexT Poll: before 1.8.7.
Gravedad CVSS v3.1: MEDIA
Última modificación:
20/07/2026
Suscribirse a Vulnerabilidades