Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55641] 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy re…

9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication. In the default configuration, this exposes the /v1 proxy to upstream provider calls using stored provider credentials and allows /v1/sear…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55687] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.…

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt_tbl array without validating that it is in the range 0..3, allowing malformed …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-39244] adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated u…

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-39903] Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an author…

Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without ho…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-53657] Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on…

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addre…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-2398] Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilM…

Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-1667] The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Sto…

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to create arbitrary posts, and, if the Advanced Custom Fields plugin is installed and acti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2025-70796] An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wirel…

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web root directory. This may allow disclosure of sensitive system files and configuration data

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56676] 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the…

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55501] 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/…

9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-54149] MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import function…

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing mode in apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file containing stdio transport with malicious commands and trigg…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61434] PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command executio…

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61437] PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vuln…

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandbo…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-60091] PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the…

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56279] Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RP…

Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56305] Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoin…

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate users and achieve full account takeover.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56254] In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distrib…

In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker performing a man-in-the-middle attack or compromising the Capgo server can create a validly signed update bundle and cause devices to install an update not produced by …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-29519] Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflect…

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that i…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-38057] The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication…

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate devi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-38059] The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An …

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, …

nvdaltovulnerabilidad CVSS 7.5 NVD