Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109331] Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeH…

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execut…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-109321] Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary…

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrativ…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109325] Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profi…

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109313] Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows att…

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restoration. Attackers can obtain a persistent remember-me cookie after the password step and restore it as a fully authorized session without completing the second factor.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109314] Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows pu…

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the username and bearer token, enabling takeover of more privileged accounts.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109317] Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegat…

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109318] Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authentica…

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell substitutions into profile fields. When the gravuser or gravfull author mode is enabled, attackers can set a malicious username, full name, or email that reaches PHP exec() via git commit --author, running commands as the web-server accou…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109308] Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in…

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to UpdatesModel without Component::cleanseConfig(), allowing behavior and event-handler injection. Authenticated control panel users with the performUpdates permission or Updates-utility access can supply 'as' or 'on' keys, such as an AttributeTypecastBehavior gadg…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109312] Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), whic…

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109305] Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to i…

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates to execute code as the web user.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109290] Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPre…

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing administrator's session token from local storage and take over the instance.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109291] Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authe…

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109286] Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncSt…

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's session token by posting unvalidated verify:chat messages. Attackers can supply a path-traversal chat id redirecting the authenticated stats export request to the auths endpoint, receiving the victim's JWT for full API access.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109242] FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progr…

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109237] Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API …

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109238] Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API cli…

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-108907] A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the …

A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-108914] A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality…

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerabili…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-9191] Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not suffici…

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-85955] Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote…

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

nvdcriticovulnerabilidad CVSS 9.9 NVD