Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/07/2026

[CVE-2025-51678] An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory add…

An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to unexpected behavior.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-9171] IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial…

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-58195] Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools i…

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/…

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

17/07/2026

[CVE-2026-52746] JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs t…

JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-45162] Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, …

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Ass…

nvdaltovulnerabilidad CVSS 8.0 NVD

A Alto vulnerabilidad

17/07/2026

[CVE-2026-45309] AsyncSSH is a Python package which provides an asynchronous client and server implementation of the …

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config rel…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

17/07/2026

[CVE-2026-9762] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when…

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-50273] Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Data…

Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction, allowing a remote unauthenticated attacker to send a baggage header with many comma-separated key-value pairs or …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-63101] Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthe…

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint which lacks any authentication decorator. Attackers can enumerate sequential group IDs via brute-force, tri…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-57860] ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the M…

ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and args values (for example, command: bash with args: ['-c', 'touch /tmp/pwned']). When a user runs the …

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-49211] Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Auto…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into …

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-49212] Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC comput…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-12691] Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platfor…

Missing authentication for critical function vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-60025] Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extens…

Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-14741] HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in p…

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-63093] Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attack…

Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted repository, Cursor automatically resolves and executes the workspace-resident git.exe during IDE startup and on a recurring timed cadence without …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-63094] SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that al…

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a v…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-51082] A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE…

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with privileges to call "vncproxy" to hijack a VNC session that is established in parallel by a different us…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-7488] Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce a…

Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-16016] A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run…

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the argument callback_url leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inactiv…

nvdaltovulnerabilidad CVSS 7.3 NVD