Alertas de Seguridad de la Información

M Alto vulnerabilidad

31/07/2026

[CVE-2026-62999] Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-…

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-62391] The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server…

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-63222] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without …

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56673] ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to…

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated crafted POST /prompt workflow using LoadImage or sibling nodes to probe arbitrary host paths and exfilt…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56671] ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2…

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to use traversal, encoded traversal, absolute paths, or an unbounded path_index to read image-decodable f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-12942] IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the s…

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-62663] Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4,…

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as file paths via Path(value) and pass them directly to open(file_path, "rb") without any path sanitization, canonicalization, or directory restriction. An attacker who controls template variables passed to …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-52680] Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when …

Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions. Thi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-15435] IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a …

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-14519] IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a …

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-59310] VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor …

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-5491] DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote…

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 6067 by default. The issue results from the lack of proper validation of a us…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-5487] DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote…

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a us…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-67429] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.dow…

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-11974] The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter…

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54650] openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in …

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-55389] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in src/datamodel_code_generator/parser/jsonschema.py through is_url and _get_ref_body without containing file:// or ../ traversal references to th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-55390] datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.6…

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. T…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-15280] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is aff…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segment injection vulnerability in the collective routing mechanism.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14973] IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written out…

IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.

nvdcriticovulnerabilidad CVSS 9.3 NVD