Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/06/2026

[CVE-2026-56078] PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to …

PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

18/06/2026

[CVE-2026-54017] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in `backend/open_webui/routers/terminals.py` does not fully confine the user-controlled `path` segment before forwarding it to an admin-configured terminal server. An authenticated user who has been granted access to a terminal server can craft `path`…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-46699] conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted…

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository inv…

nvdaltovulnerabilidad CVSS 7.6 NVD

C Alto vulnerabilidad

18/06/2026

[CVE-2026-43994] Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contai…

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs…

nvdaltovulnerabilidad CVSS 8.1 NVD

E Alto vulnerabilidad

18/06/2026

[CVE-2026-44691] In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/t…

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/s…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

18/06/2026

[CVE-2026-44688] In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory …

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt inj…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-11395] The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions…

The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull_the_trigger. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the admin-co…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-9860] The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code …

The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cf_images_do_setup AJAX handler, which requires only the upload_files capability (Author+) rather than manage_options before writing to wp-config.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-48764] TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by re…

TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by resolving a hostname once and checking whether the resolved IP belongs to a forbidden range allowing for DNS rebinding bypass. The root cause is a time-of-check to time-of-use gap in the SSRF guard. The validator resolves the hostname and approves it, but the later request path performs a fresh resolu…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-45617] LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version…

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-48759] TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Referenc…

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-45357] LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version…

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without co…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-50196] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propag…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-50200] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default li…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-50194] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware responsible for restricting access to the endpoints uses the `Host` HTTP header rather than the…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-48979] PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography…

PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

17/06/2026

[CVE-2026-10696] Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026…

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-53871] Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cooki…

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.

nvdaltovulnerabilidad CVSS 8.1 NVD

F Alto vulnerabilidad

17/06/2026

[CVE-2026-42530] NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is co…

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-54814] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.

nvdaltovulnerabilidad CVSS 8.1 NVD