Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/07/2026

[CVE-2026-18022] Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write d…

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-12357] Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability.…

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the generateFileContent function. The issue results from the lack of proper neut…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-13268] G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This v…

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Backup Service. By…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67428] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emit…

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, a…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67201] V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulne…

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67424] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP …

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67425] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat …

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67427] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workf…

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-16328] In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was…

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This v…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-40272] Improper Input Validation in the decode() function of the traceparser library could allow an attacke…

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-14266] 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerab…

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54727] proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restor…

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in ver…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64558] In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey…

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64559] In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY…

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64560] In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF c…

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54574] proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro instal…

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an ab…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-15144] @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned …

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in d…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67192] Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability tha…

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets when a GCM cipher is negotiated. Attackers can craft packets with an unvalidated length field passed directly to the GCM decrypt function, overwriting the stack cookie and return address to potentially achiev…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-16463] A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflo…

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-65947] Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2

nvdaltovulnerabilidad CVSS 7.3 NVD