Alertas de Seguridad de la Información

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-37270] Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused…

Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-coded credentials in the firmware.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-37271] Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, T…

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.

nvdcriticovulnerabilidad CVSS 9.8 NVD

P Alto vulnerabilidad

07/07/2026

[CVE-2026-14380] DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. …

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code e…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-59706] mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow s…

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm en…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-54607] FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI s…

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT's internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata.…

nvdaltovulnerabilidad CVSS 7.7 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-55075] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-55418] FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handl…

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply a…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-42958] The application contains a use-after-free vulnerability that can be exploited to cause memory corrup…

The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

C Crítico vulnerabilidad

07/07/2026

[CVE-2026-46354] Coder allows organizations to provision remote development environments via Terraform. In versions p…

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"v…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-49033] The application contains a stack-based buffer overflow vulnerability that can be exploited by an att…

The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-49229] Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling …

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actual session tokens for the disabled user remain valid. The shared session validation path accepts any existing token row that has not expired without checking whether the associated user is still enabled, allowing a disabled…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-58473] Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated at…

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-58583] FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows…

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physical memory mapping at \Device\PhysicalMemory. Fixed in version 1.0.7.6. The fixed driver is currently available in the Windows 11 25H2 HLK (Hardware Lab Kit). The fixed driver may be available through Windows Update or from L…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-59707] LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/ap…

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges w…

nvdaltovulnerabilidad CVSS 8.6 NVD

G Alto vulnerabilidad

07/07/2026

[CVE-2026-58469] GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in …

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cause the function to decrement a pointer past the start of the buffer when processing an all-whitespa…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-44454] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) cou…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

07/07/2026

[CVE-2026-49471] Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilitie…

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary c…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-59708] The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without…

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings, quantities, buy prices, and performance metrics without authentication.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-59800] 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /ap…

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-7017] HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect target…

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorizati…

nvdaltovulnerabilidad CVSS 7.1 NVD