Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/07/2026

[CVE-2026-50144] ncnn is a high-performance neural network inference framework optimized for the mobile platform. In …

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id …

nvdaltovulnerabilidad CVSS 7.1 NVD

B Crítico vulnerabilidad

15/07/2026

[CVE-2026-53513] Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @bet…

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callb…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59955] Apollo is a reliable configuration management system suitable for microservice configuration managem…

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59954] Apollo is a reliable configuration management system suitable for microservice configuration managem…

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-20153] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS en…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20153 are related to improper input validation that are grouped under …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61427] PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the…

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is a…

nvdaltovulnerabilidad CVSS 7.3 NVD

O Alto vulnerabilidad

15/07/2026

[CVE-2026-56398] Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentica…

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with …

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48351] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48352] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48334] Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary…

Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48328] ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security…

ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 7.7 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48284] ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary …

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15769] Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior …

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-13001] The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to mi…

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50670] Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50417] Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50370] Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code ov…

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50328] Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampe…

Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-55899] Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute cod…

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-3576] The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forge…

The Planyo Online Reservation System plugin for WordPress is vulnerable to Server-Side Request Forgery leading to Local File Inclusion in all versions up to, and including, 3.0. The ulap.php file acts as an AJAX proxy and is directly accessible without WordPress bootstrapping or any authentication. The send_http_post() function validates the host of the provided URL against an allowlist that inclu…

nvdaltovulnerabilidad CVSS 7.2 NVD