Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-14380

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle&#39;s Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands. The Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db. An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.

Gravedad CVSS v3.1: ALTA

Última modificación:

10/07/2026

CVE-2026-58266

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki&#39;s webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/07/2026

CVE-2026-59153

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.

Gravedad CVSS v4.0: BAJA

Última modificación:

08/07/2026

CVE-2026-59706

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm endpoint.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

08/07/2026

CVE-2026-55490

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5.

Gravedad CVSS v3.1: MEDIA

Última modificación:

10/07/2026

CVE-2026-55075

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder&#39;s OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean `false` so an absent or non-boolean claim was treated as verified. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 restricts the email fallback to first-time and legacy linking and defaults `email_verified` to false when the claim is absent or of an unexpected type. As a workaround, configure the OIDC provider to disallow self-registration or to require email verification before issuing tokens.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/07/2026

CVE-2026-54601

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT allows an authenticated tenant user to call POST /api/core/dataset/collection/create/reTrainingCollection in a way that persists a server-owned datasetId value from another tenant. This creates mixed dataset objects and downstream dataset, collection, and training endpoints then make authorization decisions from inconsistent ownership anchors, allowing cross-tenant read, update, and delete access when mixed object ids are known. This issue is fixed in version 4.15.0-beta4.

Gravedad CVSS v3.1: MEDIA

Última modificación:

08/07/2026

CVE-2026-54602

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and response traces only by requestId without team scoping, allowing any authenticated user to read another team&#39;s prompts, retrieved RAG chunks, and completions if the requestId is known. This issue is fixed in version 4.15.0.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/07/2026

CVE-2026-54607

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT&#39;s internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata. This issue is fixed in version 4.15.0-beta4.

Gravedad CVSS v3.1: ALTA

Última modificación:

08/07/2026

CVE-2026-55408

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** Koodo Reader is an ebook reader. In version 2.3.0 and earlier, Koodo Reader is vulnerable to remote code execution through malicious EPUB files because the open-book IPC handler enables nodeIntegrationInSubFrames and EPUB chapter content is rendered with unsanitized innerHTML. An attacker can craft an EPUB book that, when imported and opened by the victim, instantiates a hidden iframe with Node.js API access and executes arbitrary operating system commands with the victim user&#39;s privileges. This issue is fixed in version 2.3.1.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/07/2026

CVE-2026-55418

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller&#39;s team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team&#39;s key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5.

Gravedad CVSS v3.1: ALTA

Última modificación:

09/07/2026

CVE-2026-54698

Fecha de publicación:

07/07/2026

Idioma:

Inglés

*** Pendiente de traducción *** Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table&#39;s row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.

Gravedad CVSS v4.0: MEDIA

Última modificación:

10/07/2026

Suscribirse a Vulnerabilidades