Alertas de Seguridad de la Información

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64612] A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng…

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-55626] xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session …

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active d…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-48812] FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version …

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was creat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-39878] Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the …

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64191] In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block tra…

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the chip->words[256] register array, but does not validate it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the un…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64206] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendin…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for pending_rx_work. process_pending_rx() takes the same mutex, so teardown can deadlock against the worker it is flushing. This issue was found by our static analysis tool and then manually rev…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64188] In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpo…

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64189] In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race betw…

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A …

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-54538] xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the …

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted packet that forces the xrdp process or thread into an infinite, CPU-bound loop. B…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-54051] Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandb…

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but `ShellExecutor` runs that string through `/bin/sh -c`. So any wildcard al…

nvdcriticovulnerabilidad CVSS 9.9 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-44178] xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vu…

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap-based buffer overflow vulnerability within the virtual channel forwarding mechanism. When forwarding data from a remote client to the internal channel server, the xrdp process utilizes a fixed-size buffer without adequate bounds checking on the incoming payload. An authenticated remote attacker can exploit this flaw by sen…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-46555] WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read a…

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these i…

nvdaltovulnerabilidad CVSS 7.7 NVD

N Crítico vulnerabilidad

20/07/2026

[CVE-2026-41252] xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp,…

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with…

nvdcriticovulnerabilidad CVSS 9.8 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-41521] xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerabili…

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-39879] Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/…

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edit…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-63429] HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authe…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoi…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-46415] The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate request…

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy. In deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the …

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-45713] Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP s…

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value (0 ⇒ "no limit"). The same applies to the HTTP /api/v1/send endpoint, whose request body is decoded with json.NewDecoder…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-35198] HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.

nvdcriticovulnerabilidad CVSS 9.0 NVD

W Alto vulnerabilidad

20/07/2026

[CVE-2026-28220] Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior …

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the master node deserialize an attacker-controlled callable and execute it under an attacker-controlled RBAC c…

nvdaltovulnerabilidad CVSS 8.4 NVD