Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61438] PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_…

PraisonAI before 4.6.78 contains a remote code execution vulnerability in JobWorkflowExecutor._exec_inline_python() due to insufficient AST validation of workflow script steps. Attackers can create malicious YAML workflow files with import os statements followed by os.system() calls that bypass sandbox checks and execute arbitrary OS commands with process privileges.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-58655] The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stor…

The bundled Grav Flex Objects plugin (getgrav/grav-plugin-flex-objects) before 1.4.0 contains a stored server-side template injection vulnerability. When rendering dynamic collection or object titles, the plugin passes user-controlled frontmatter values (page.header.flex.collection.title or page.header.flex.object.title) to Twig's template_from_string(), causing them to be evaluated as Twig code r…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-60085] PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subproce…

PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are completely ignored. Attackers can execute arbitrary subprocess commands, read sensitive files, and perform destructive operations despite explicit security policy config…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-57996] phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint tha…

phpMyFAQ before 4.1.5 contains a privilege escalation vulnerability in the user/add API endpoint that allows non-SuperAdmin administrators to create SuperAdmin accounts. A delegated administrator with USER_ADD/EDIT/DELETE permissions can call POST /admin/api/user/add with isSuperAdmin: true and attacker-chosen credentials to create a SuperAdmin account, then authenticate as that account to achieve…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-56699] Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSea…

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.

nvdcriticovulnerabilidad CVSS 10.0 NVD

O Alto vulnerabilidad

15/07/2026

[CVE-2026-56400] open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrar…

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-56339] Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabas…

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST SECURITY DEFINER RPC function public.rescind_invitation that allows unauthenticated attackers to enumerate organization existence. The function returns distinct error messages (NO_ORG vs NO_RIGHTS) when called with only a publishable API key, enabling attackers to discover valid organiza…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

15/07/2026

[CVE-2026-56398] Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentica…

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with …

nvdaltovulnerabilidad CVSS 7.3 NVD

D Alto vulnerabilidad

15/07/2026

[CVE-2026-40633] Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains…

Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

15/07/2026

[CVE-2026-56287] A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/…

A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The orderBy and sortOrder request parameters are concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view clients to inject arbitrary SQL via a crafted orderBy value. This can be leveraged …

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

15/07/2026

[CVE-2026-57821] A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in…

A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduc…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

15/07/2026

[CVE-2026-35152] A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint)…

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter values are incorporated into the generated SQL query without sufficient validation, allowing an authenticated user with permission to run reports to inject arbitrary SQL via crafted parameter values. This can be leveraged to perform unauthori…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15804] The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can …

The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compromising the confidentiality, integrity, and availability of database data.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-14251] A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate reso…

A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15583] A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate…

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Medio vulnerabilidad

15/07/2026

CVE-2026-50341 Windows NTFS Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-50341 Windows NTFS Information Disclosure Vulnerability. Tipo: Divulgación de Información.

windowsinfo-disclosure Microsoft MSRC

M Alto vulnerabilidad

15/07/2026

CVE-2026-50375 DirectX Graphics Kernel Elevation of Privilege Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-50375 DirectX Graphics Kernel Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).

eop Microsoft MSRC

M Alto vulnerabilidad

15/07/2026

[CVE-2026-42936] The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at t…

The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12512] The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied…

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12281] The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode…

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach the application, an unauthenticated attacker can log in with forged identity headers and, when automat…

nvdaltovulnerabilidad CVSS 8.1 NVD