Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-82067

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

08/09/2026

CVE-2026-82068

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sending specially crafted retryable write commands. The crash state is durably persisted, causing the server process to repeatedly crash on restart and potentially propagating to additional nodes in a sharded cluster. Manual intervention is required to restore service availability.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/09/2026

CVE-2026-82069

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security issue in MongoDB Server&#39;s query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users&#39; operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.

Gravedad CVSS v4.0: MEDIA

Última modificación:

08/09/2026

CVE-2026-82057

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention to remediate.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/09/2026

CVE-2026-82058

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A flaw in MongoDB&#39;s JSON Schema validation error generation code allows an authenticated user with readWrite privileges to crash the mongod server. When a BSON document containing an array with a malformed numeric field name fails a $jsonSchema items type constraint, the error generation path performs unsafe numeric conversion on the user-controlled field name without proper exception handling, resulting in an uncaught exception that terminates the server process. This is possible because incoming wire protocol BSON validation does not enforce that array element field names are valid, in-range numeric indices.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/09/2026

CVE-2026-82059

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user rather than being restricted to internal cluster operations. By crafting a malformed index specification within this expression, an authenticated user with read-only privileges could trigger an assertion failure in the index key generation code path. In certain build configurations, this assertion failure results in termination of the mongod process, causing a denial of service to all connected clients.

Gravedad CVSS v4.0: MEDIA

Última modificación:

08/09/2026

CVE-2026-82061

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A use-after-free security issue exists in the server&#39;s query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/09/2026

CVE-2026-82062

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation&#39;s namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections&#39; data.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/09/2026

CVE-2026-82060

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors.

Gravedad CVSS v4.0: BAJA

Última modificación:

08/09/2026

CVE-2026-82054

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security issue exists in MongoDB server&#39;s JSON Pointer parser used during $jsonSchema query filter processing. When a find command includes a specially crafted $jsonSchema filter field, the parser processes the input without enforcing adequate limits on iteration count or total allocation size, resulting in significant memory amplification. Under concurrent request load, the cumulative memory consumption can exhaust available heap memory, causing the server&#39;s out-of-memory handler to terminate the mongod process and deny service to all connected clients.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/09/2026

CVE-2026-82055

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A security issue exists in MongoDB&#39;s 2dsphere index key generation that can cause a server crash due to a null pointer dereference. When a specially crafted GeoJSON document is inserted into a collection with a 2dsphere index, an inconsistency in geometry parsing can leave an internal object in an invalid, partially initialized state. During subsequent index key generation, access to this improperly initialized object results in a null pointer dereference that terminates the mongod process. An authenticated user with write access can use this to cause a denial of service.

Gravedad CVSS v4.0: ALTA

Última modificación:

08/09/2026

CVE-2026-82056

Fecha de publicación:

08/09/2026

Idioma:

Inglés

*** Pendiente de traducción *** A race condition in MongoDB server&#39;s text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This

Gravedad CVSS v4.0: MEDIA

Última modificación:

08/09/2026

Suscribirse a Vulnerabilidades