Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/07/2026

[CVE-2026-59707] LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/ap…

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges w…

nvdaltovulnerabilidad CVSS 8.6 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-44454] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) cou…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-6101] The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write…

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, an…

nvdaltovulnerabilidad CVSS 7.5 NVD

T Alto vulnerabilidad

04/07/2026

[CVE-2026-14535] In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unc…

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in the shared AnalysisContext.reported_shortened_code set. When the MLAllowlist analysis pass subsequen…

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

04/07/2026

[CVE-2026-14534] Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard librar…

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickling's check_safety() function returns LIKELY_SAFE with zero findings for pickle payloads that invoke dangerous functions including _posixsubprocess.fork_e…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71362] picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functio…

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-57516] Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that a…

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=Fal…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

01/07/2026

[CVE-2026-6682] In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= f…

In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/up…

nvdaltovulnerabilidad CVSS 7.6 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11541] IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Se…

IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.

nvdaltovulnerabilidad CVSS 7.4 NVD

N Alto vulnerabilidad

30/06/2026

[CVE-2026-12243] NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issu…

NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but fails to account for percent-encoded traversal sequences such as `..%2f`. The `url2pathname()` function decodes these sequences after the validation step, allowing an attacker to bypass the protectio…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57955] SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to…

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to per…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-40524] FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() fu…

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolea…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-10083] The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before renderi…

The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Site Scripting vulnerability. When a persistent object cache is enabled, cache keys derived from unsanitised user input (e.g. a transient name created by another APCu Manager WordPress plugin before 4.5.0 from an unauthenticated request) are o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55975] A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanit…

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

nvdaltovulnerabilidad CVSS 7.2 NVD

D Alto vulnerabilidad

26/06/2026

[CVE-2026-47214] Docling simplifies document processing by parsing diverse formats and providing integrations with th…

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

C Alto vulnerabilidad

25/06/2026

[CVE-2026-40083] Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have S…

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items by calling cacti_unserialize(stripslashes(gnrv('selected_graphs_array'))). The cacti_unserialize() function calls unserialize() with allowed_classes set to fal…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-45233] HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authentic…

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory bounda…

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53146] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain resp…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the …

nvdaltovulnerabilidad CVSS 7.1 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-8592] OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin …

OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-49247] Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog…

Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Client and Version fields and uses them unsanitized as components of the on-disk filename when persisting client-uploaded log documents. As a result, any authenticated non-admin user can include ../ sequences in the Client field to cause Jellyfin…

nvdaltovulnerabilidad CVSS 8.8 NVD