Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/07/2026

[CVE-2026-14251] A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate reso…

A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15583] A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate…

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Medio vulnerabilidad

15/07/2026

CVE-2026-50341 Windows NTFS Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-50341 Windows NTFS Information Disclosure Vulnerability. Tipo: Divulgación de Información.

windowsinfo-disclosure Microsoft MSRC

M Alto vulnerabilidad

15/07/2026

CVE-2026-50375 DirectX Graphics Kernel Elevation of Privilege Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-50375 DirectX Graphics Kernel Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).

eop Microsoft MSRC

M Alto vulnerabilidad

15/07/2026

[CVE-2026-42936] The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at t…

The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12512] The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied…

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12281] The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode…

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach the application, an unauthenticated attacker can log in with forged identity headers and, when automat…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

15/07/2026

[CVE-2026-46817] Vulnerabilidad explotada activamente en Oracle E-Business Suite

CISA confirma explotación activa de una vulnerabilidad en Oracle E-Business Suite. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-18.

oracleexplotación activavulnerabilidad CISA KEV

K Alto vulnerabilidad

15/07/2026

[CVE-2023-4346] Vulnerabilidad explotada activamente en KNX Association KNX Protocol Connection Authorization Option 1

CISA confirma explotación activa de una vulnerabilidad en KNX Association KNX Protocol Connection Authorization Option 1. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-29.

knx associationexplotación activavulnerabilidad CISA KEV

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-5269] In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden sys…

In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-5270] An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control…

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15752] A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f92…

A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-51807] Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions …

Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are written to j2k_codeblock::pass_length[128]. A crafted JPEG 2000 codestream containing malformed PPM packet headers can trigger a heap-based out-of-bounds write in j2k_precinct_subband::parse_pack…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-51808] Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitra…

Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded function in source/core/interface/decoder.cpp

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56362] A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifi…

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a cr…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56363] A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, af…

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56364] A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, …

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID. The issue affects all versions before commit 0360cc3 (Dec 5, 2024) and leads to denial of ser…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56365] A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the …

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB …

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-59733] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delet…

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-54572] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the desti…

nvdaltovulnerabilidad CVSS 7.5 NVD