Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47866] VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the ne…

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47867] VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with netwo…

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47868] VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with …

VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47869] VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated u…

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47870] VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated us…

VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47871] VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation…

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-56741] JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 …

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeome…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-56171] Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthori…

Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-49485] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches(), matchesFull(), and replaceMatches() pass user-controlled regular expressions to Java's Pattern.compile() and …

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

17/07/2026

[CVE-2026-54498] view_component is a framework for building reusable, testable, and encapsulated view components in R…

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can return HTML-unsafe strings that bypass the escaping behavior applied to normal #call return values. This creates an XSS risk when downstream applications use around_render to wrap, replace, instrument, or conditionally retu…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-50271] Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that…

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request whose baggage header contains an arbitrarily large number of comma-separ…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-50272] dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in package…

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on extraction. A remote, unauthenticated attacker can send a request whose baggage header contains a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-50274] Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling…

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits on the extract path. A remote, unauthenticated attacker can send a request…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-52584] Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensit…

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

nvdaltovulnerabilidad CVSS 7.1 NVD

N Alto vulnerabilidad

17/07/2026

[CVE-2026-44891] Netty is a network application framework for development of protocol servers and clients. Prior to 4…

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumu…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-45784] rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80…

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attac…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-48062] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in …

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like content could pass validation such as uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

17/07/2026

[CVE-2026-13445] IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile …

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents, appends attacker-controlled data, and uploads a copy containing victim data to the attacker's namespace (c…

nvdaltovulnerabilidad CVSS 8.1 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-13446] IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptog…

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-8505] IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic…

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the ow…

nvdcriticovulnerabilidad CVSS 9.8 NVD