Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-53701

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** An out-of-bounds write vulnerability was found in GStreamer&#39;s H.266/VVC PPS picture partition parser in gst-plugins-bad. In the multi-slice-in-tile processing of gst_h266_parser_parse_picture_partition() (gsth266parser.c), the loop iterates without checking that the slice index stays within bounds, writing past three fixed-size arrays (slice_height_in_ctus, slice_top_left_ctu_x, slice_top_left_ctu_y) in the GstH266PPS structure. While the initial proof-of-concept demonstrated a 4-byte out-of-bounds write, the code permits larger writes across multiple iterations. A crafted H.266/VVC media file can trigger this vulnerability.

Gravedad CVSS v3.1: MEDIA

Última modificación:

11/06/2026

CVE-2026-52859

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visible terminal screen into the scrollback buffer when a snapshot is taken. For each screen cell it walks the cell&#39;s chars[] array with no upper bound, stopping only when it encounters a NUL terminator. When a cell legitimately fills all VTERM_MAX_CHARS_PER_CELL (6) slots — a base character plus five combining marks — the bundled libvterm returns the array without a terminating NUL, so the loop reads past the fixed six-element array and appends the out-of-bounds values to a buffer reserved for only six characters. A program whose output is rendered inside a :terminal window can trigger this with a short byte sequence and no Vim scripting, leading to a crash. This issue has been patched in version 9.2.0565.

Gravedad CVSS v4.0: MEDIA

Última modificación:

15/06/2026

CVE-2026-52858

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python&#39;s import machinery. Because the buffer&#39;s working directory is on sys.path, opening a hostile .py file with a sibling Python package and invoking omni-completion runs that package&#39;s top-level code as the editing user. This issue has been patched in version 9.2.0561.

Gravedad CVSS v4.0: ALTA

Última modificación:

15/06/2026

CVE-2026-52860

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim&#39;s Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation (GHSA-52mc-rq6p-rc7c) does not cover this path, because the attacker-controlled code is not a harvested import/from statement. This issue has been patched in version 9.2.0597.

Gravedad CVSS v4.0: ALTA

Última modificación:

15/07/2026

CVE-2026-47177

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, a user who can configure bot settings can set the ticket transcript channel to a channel they can read. When tickets are closed, the bot exports the full ticket history and sends it to that configured transcript channel. This can expose private ticket messages to users who could not read the original ticket channel. This issue has been patched in version 1.0.4.

Gravedad CVSS v4.0: MEDIA

Última modificación:

11/06/2026

CVE-2026-47189

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the AutoMod remove flow looks up and deletes rules by global database ID without verifying that the rule belongs to the guild where the command is executed. A user can learn a victim guild’s AutoMod rule ID through autocomplete, then remove that rule from another guild where they have Manage Server. This issue has been patched in version 1.0.5.

Gravedad CVSS v4.0: ALTA

Última modificación:

11/06/2026

CVE-2026-47250

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege escalation attack within Kubernetes environments. An attacker who already has limited cluster or codebase access, for example, a developer with pod-deployment permissions but not cluster-admin credentials, can plant a single structured JSON line in an application&#39;s log output. When an operator with a privileged kubeconfig uses the MCP server to read those logs and their AI agent follows the injected instruction, kubectl_generic is called with --server=https://attacker.example.com and --insecure-skip-tls-verify=true. kubectl sends all API requests, including the Authorization: Bearer header from the operator&#39;s kubeconfig to the attacker&#39;s endpoint. The captured token can then be replayed directly against the real Kubernetes API server, granting the attacker the full RBAC permissions of the operator&#39;s service account. This issue has been patched in version 3.7.0.

Gravedad CVSS v3.1: MEDIA

Última modificación:

11/06/2026

CVE-2026-47188

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.5, the latest release suppresses mentions in several moderation commands, but /unban and /unwarn still echo user-controlled reason text in public bot messages without allowedMentions. A moderator can use @everyone or @here in the reason and make the bot send a mass ping. This issue has been patched in version 1.0.5.

Gravedad CVSS v4.0: BAJA

Última modificación:

13/06/2026

CVE-2026-47181

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection vulnerability in the password reset endpoint allows any authenticated user to change the password of an account, leading to full account takeover. An attacker only needs a registered account and a valid password reset token for their own account. This issue has been patched in version 1.0.0.

Gravedad CVSS v4.0: ALTA

Última modificación:

15/06/2026

CVE-2026-48547

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the GitHub Actions runner with contents write permissions and access to GITHUB_TOKEN.

Gravedad CVSS v4.0: ALTA

Última modificación:

14/07/2026

CVE-2026-47171

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing mass mentions. If the bot has permission to mention everyone, the reminder can ping the entire server or channel later. This issue has been patched in version 1.0.3.

Gravedad CVSS v4.0: ALTA

Última modificación:

11/06/2026

CVE-2026-47172

Fecha de publicación:

11/06/2026

Idioma:

Inglés

*** Pendiente de traducción *** Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflow runs on pull requests, and the deploy workflow checks out the triggering workflow’s head_sha, builds that code into a Docker image, pushes it as latest, and triggers production deployment. If an attacker can open a pull request from a branch named main, the deploy workflow condition can treat the PR build as deployable and build the attacker-controlled commit in a privileged deployment context. This can result in malicious container deployment and production bot compromise. This issue has been patched in version 1.0.3.

Gravedad CVSS v4.0: CRÍTICA

Última modificación:

11/06/2026

Suscribirse a Vulnerabilidades