Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-16215

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: MEDIA

Última modificación:

20/07/2026

CVE-2026-16213

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry_protection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of sensitive information. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: MEDIA

Última modificación:

20/07/2026

CVE-2026-16214

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: BAJA

Última modificación:

22/07/2026

CVE-2026-16212

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: BAJA

Última modificación:

20/07/2026

CVE-2026-16211

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.increment_hostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can lead to race condition. Attacks of this nature are highly complex. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: BAJA

Última modificación:

20/07/2026

CVE-2026-16210

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: MEDIA

Última modificación:

21/07/2026

CVE-2026-16209

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Applying a patch is advised to resolve this issue.

Gravedad CVSS v4.0: MEDIA

Última modificación:

20/07/2026

CVE-2026-16208

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw has been found in django-tastypie up to 0.15.1. The affected element is the function CacheThrottle/CacheDBThrottle of the file tastypie/throttle.py. This manipulation causes race condition. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: BAJA

Última modificación:

22/07/2026

CVE-2026-16207

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: MEDIA

Última modificación:

20/07/2026

CVE-2026-16206

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security vulnerability has been detected in django-oauth django-oauth-toolkit 3.3.0. This issue affects the function _load_id_token of the file oauth2_provider/oauth2_validators.py. The manipulation leads to session expiration. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: MEDIA

Última modificación:

20/07/2026

CVE-2026-16205

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: BAJA

Última modificación:

20/07/2026

CVE-2026-16204

Fecha de publicación:

19/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This affects the function tool_run_script_execute of the file claw/services/tools/script.c of the component Telegram-to-AI Tool Execution Flow. Performing a manipulation results in code injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Gravedad CVSS v4.0: BAJA

Última modificación:

21/07/2026

Suscribirse a Vulnerabilidades