Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/07/2026

[CVE-2026-62685] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directo…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61371] Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, …

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (“truncation-before-validation”).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-60005] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the …

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability m…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-55242] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-50147] Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57…

Metabase is an open-source business intelligence and embedded analytics tool. From 1.57.0 until 1.57.19.1, 1.58.14.1, 1.59.10, and 1.60.4, an attacker who can configure a Metabase database connection can read arbitrary files from the Metabase server's filesystem by adding unsafe JDBC parameters to a MySQL or MariaDB connection, causing the driver to read files from the Metabase host and expose the…

nvdaltovulnerabilidad CVSS 7.6 NVD

T Alto vulnerabilidad

15/07/2026

[CVE-2026-46709] Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby insert…

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby inserts dropped file paths from tabby-electron/src/pathDrop.ts into the active shell without neutralizing command substitution metacharacters such as $(…) and `…`, so the incomplete CVE-2026-45038 fix for control characters still allows code execution when the victim presses Enter. This issue is fixed in …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-47158] Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO aut…

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact after failed token exchange, allowing an unauthenticated attacker to induce IdP authentication and red…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-47164] Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO log…

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-45805] Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP'…

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-45806] Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's re…

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in backend/src/app/rpc/commands/media.clj, where media/download-image in backend/src/app/media.clj used the shared HTTP client without …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61835] Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, th…

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but never blocks the literal address itself. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61836] Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, wh…

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in api/src/utils/get-cache-key.ts includes version, path, query, and accountability.user but omits authorization context such as share, role, roles, admin, app, and policies. Directus share tokens and anonymous requests can both reduce to user…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61644] FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api…

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat and collection context, but the initialId center-node lookup is not bound to that authorized context. A low-privileged tenant user can call the endpoint with valid attacker-owned appId, chatId, chatItemDataId, and collecti…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59762] When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase…

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.   Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-54563] Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV a…

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the con…

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

15/07/2026

[CVE-2026-55723] When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annot…

When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these CRDs or annotations may…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-54560] Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's…

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as fi…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-42533] A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching …

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyon…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-58558] Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnera…

Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15809] A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allow…

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

nvdaltovulnerabilidad CVSS 7.8 NVD