Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-84499

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Red Hat Ansible Automation Platform&#39;s automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user&#39;s stored password in plaintext.

Gravedad CVSS v3.1: ALTA

Última modificación:

26/09/2026

CVE-2026-84474

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw was found in Red Hat Ansible Automation Platform&#39;s automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling host when the controller is deployed behind the AAP gateway with an empty proxy allow-list. By reading the secret and spoofing X-Forwarded-For to match any host in the job template&#39;s inventory, a minimally privileged or unauthenticated remote attacker can launch the job template against arbitrary managed hosts using the job template&#39;s credentials, resulting in privilege escalation and remote code execution on managed hosts.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

24/09/2026

CVE-2026-82356

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Imprivata EAM

Gravedad CVSS v3.1: ALTA

Última modificación:

25/09/2026

CVE-2026-82368

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user.

Gravedad CVSS v4.0: ALTA

Última modificación:

01/10/2026

CVE-2026-77601

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

23/09/2026

CVE-2026-77602

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.

Gravedad CVSS v3.1: CRÍTICA

Última modificación:

29/09/2026

CVE-2026-77423

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java&#39;s backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.

Gravedad CVSS v3.1: ALTA

Última modificación:

30/09/2026

CVE-2026-77394

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator&#39;s browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim&#39;s bearer token, account takeover, and actions with the victim&#39;s privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.

Gravedad CVSS v3.1: ALTA

Última modificación:

23/09/2026

CVE-2026-76648

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF&#39;s get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, &#39;read&#39;, obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, &#39;add&#39;, create_kwargs_check) can_access(model, &#39;copy_related&#39;, obj) For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.

Gravedad CVSS v3.1: ALTA

Última modificación:

26/09/2026

CVE-2026-77285

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent&#39;s exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

Gravedad CVSS v4.0: BAJA

Última modificación:

29/09/2026

CVE-2026-77420

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/09/2026

CVE-2026-77421

Fecha de publicación:

23/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor&#39;s regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java&#39;s backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.

Gravedad CVSS v3.1: MEDIA

Última modificación:

30/09/2026

Suscribirse a Vulnerabilidades