Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15895] OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allo…

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12997] The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a…

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly acce…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Crítico vulnerabilidad

15/07/2026

[CVE-2026-62948] OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DH…

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/sta…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59255] BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in…

BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59258] immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:user…

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.

nvdaltovulnerabilidad CVSS 8.3 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53517] Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1…

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refr…

nvdaltovulnerabilidad CVSS 8.1 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53518] Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, …

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID token…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-56687] Dell ThinOS 10, versions prior to 2605_10.2100, contain an Obsolete Feature in UI vulnerability. A l…

Dell ThinOS 10, versions prior to 2605_10.2100, contain an Obsolete Feature in UI vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-58658] GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure …

GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, c…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-58659] PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerabi…

PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is c…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-58660] Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kan…

Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member …

nvdaltovulnerabilidad CVSS 8.1 NVD

B Crítico vulnerabilidad

15/07/2026

[CVE-2026-53512] Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the lega…

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens …

nvdcriticovulnerabilidad CVSS 9.1 NVD

B Crítico vulnerabilidad

15/07/2026

[CVE-2026-53513] Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @bet…

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callb…

nvdcriticovulnerabilidad CVSS 9.6 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53514] Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1…

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invita…

nvdaltovulnerabilidad CVSS 7.7 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53515] Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11,…

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to driv…

nvdaltovulnerabilidad CVSS 7.1 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53516] Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better A…

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAuthUserInfo accepts implicit account linking when the OAuth provider asserts email_verified: true without requiring the local user row's emailVerified field to also be true, allowing an attacker who pre-registers a victim email through /sign-up/email to…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-40501] Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code executio…

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService that allows remote attackers to execute arbitrary code by delivering malicious JavaScript through controlled search provider content loaded into an Electron BrowserWindow configured with nodeIntegration enabled and contextIsolation disabled. Attackers who control a s…

nvdaltovulnerabilidad CVSS 8.8 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-45337] Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, …

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bin…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-10673] The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reasse…

The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size CONFIG_ETH_ADIN2111_BUFFER_SIZE (default 1524 bytes). In eth_adin2111_oa_data_read(), each valid chunk was memcpy'd into ctx->buf[ctx->scur] and th…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12382] A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event strea…

A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitr…

nvdaltovulnerabilidad CVSS 8.2 NVD