Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75857] CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias …

CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i sessio…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75858] CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code…

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and w…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-55839] Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Mark…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-49221] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digital_asset.s…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-49226] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplic…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-49227] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75898] RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "In…

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, un…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-45733] Trilium Notes is a cross-platform, hierarchical note taking application focused on building large pe…

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-50138] goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with Web…

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-32468] Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-28568] Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Quill Forms

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

Vulnerabilidad de autorización en ArcadeDB versiones ≤26.7.3 permite eliminación no autorizada de funciones

ArcadeDB antes de la versión 26.8.1 contiene una falla de autorización que permite a cualquier usuario con acceso a la base de datos ejecutar DELETE FUNCTION sin validación de permisos. Un atacante puede eliminar funciones del servidor comprometiendo la integridad de aplicaciones que dependen de ArcadeDB en infraestructuras altas de LATAM. La vulnerabilidad (CVSS 7.1) afecta principalmente a bases de datos expuestas internamente o en entornos multi-tenant.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

Vulnerabilidad alta en ArcadeDB: falla de autorización en plugin Gremlin (CVE-2026-75853)

El plugin Gremlin de ArcadeDB versiones ≤26.7.3 autentica conexiones pero no valida permisos de acceso a bases de datos, permitiendo que credenciales válidas accedan a cualquier base de datos sin autorización. Esto afecta directamente a empresas con infraestructuras de bases de datos distribuidas en LATAM que dependen del control granular de accesos. La vulnerabilidad tiene puntuación CVSS 8.8, indicando impacto alta en confidencialidad e integridad de datos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 6 días

Vulnerabilidad alta de autorización en Plugin API de Grav (CVE-2026-75836)

El plugin API de Grav anterior a versión 1.0.14 presenta una falla en la validación de autorización en el endpoint POST /api/v1/menubar/actions/{plugin}/{action}, permitiendo a usuarios autenticados ejecutar acciones administrativas sin permisos explícitos. La vulnerabilidad afecta principalmente a instancias de Grav con admin-next/API stack expuestas en entornos de producción. Con CVSS 8.8, representa un riesgo alta para sitios web y portales corporativos en LATAM que utilizan este CMS.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-15371] Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the…

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75091] The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnera…

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75111] Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoi…

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75482] SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that j…

SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network clie…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-71518] Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download rou…

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-73410] Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outbo…

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.…

nvdaltovulnerabilidad CVSS 8.5 NVD