Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/07/2026

[CVE-2026-55391] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62428] When grant-copy operations are processed, the respective grant may or may not already be in use by a…

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65598] n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone ope…

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, exec…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62212] OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. W…

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should have required a stronger authorization or policy check. Practical impact depends on the operator's configu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-53410] A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation proces…

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.

nvdaltovulnerabilidad CVSS 7.0 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53517] Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1…

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and mint sequence on the oauthRefreshToken row, allowing concurrent requests with the same parent refresh token to pass the revoked check and create forked refr…

nvdaltovulnerabilidad CVSS 8.1 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53518] Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, …

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID token…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-45804] Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPip…

Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom .py pipeline code to execute through the custom pipeline flow with…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48344] Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabil…

Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56648] Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorize…

Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50673] Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges local…

Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50658] Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacke…

Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62189] OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync featu…

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-45203] Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmwar…

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56676] 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the…

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and…

nvdaltovulnerabilidad CVSS 7.4 NVD

Q Alto vulnerabilidad

06/07/2026

[CVE-2026-25271] Memory Corruption when processing asynchronous input parameters due to improper handling of modified…

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58299] Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthoriz…

Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-24260] NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-…

NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering.

nvdaltovulnerabilidad CVSS 8.5 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-54353] Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation p…

Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connection later performs a separate DNS lookup through node-fetch. Since the validated IPs are never pinned to …

nvdaltovulnerabilidad CVSS 8.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53250] In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offs…

In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() The TX metadata area resides in the UMEM buffer which is memory-mapped and concurrently writable by userspace. In xsk_skb_metadata(), csum_start and csum_offset are read from shared memory for bounds validation, then read again for skb assignment. A malicious …

nvdaltovulnerabilidad CVSS 7.8 NVD