Alertas de Seguridad de la Información

S Alto vulnerabilidad

08/07/2026

[CVE-2026-59724] Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before …

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24700] An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisc…

An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The machine_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-49147] App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames…

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitises the filenames printed by -f, -g, the colored match heading, and pe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-15067] Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, incl…

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbitrary SQL execution under the provider's privileged Snowflake session, potentially enabling sensitive data exfiltration and minting of long-lived access credentials. Exploitation requires the ability for an attacker to inf…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24697] An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in C…

An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The wan_hostname configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24698] An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" bi…

An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The model_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24699] An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco…

An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The lan_ipv6_prefixlen configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10706] In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and c…

In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10708] This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A sin…

This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo appl…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

08/07/2026

[CVE-2026-56776] n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{wor…

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unin…

nvdaltovulnerabilidad CVSS 7.4 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-56297] FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_cal…

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-56246] Capgo before 12.128.2 contains a broken access control vulnerability in the organization management …

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-56250] Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field…

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availa…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

08/07/2026

[CVE-2026-53482] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-44840] Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPasswo…

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character …

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

08/07/2026

[CVE-2026-22927] Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

nvdaltovulnerabilidad CVSS 7.8 NVD

T Alto vulnerabilidad

08/07/2026

[CVE-2026-15053] Tanium addressed a denial of service vulnerability in Tanium Server.

Tanium addressed a denial of service vulnerability in Tanium Server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6820] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc…

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6818] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc…

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa…

nvdaltovulnerabilidad CVSS 7.2 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-57260] The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the applic…

The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.

nvdaltovulnerabilidad CVSS 7.8 NVD