Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15804] The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can …

The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compromising the confidentiality, integrity, and availability of database data.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-14251] A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate reso…

A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15583] A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate…

A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-42936] The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at t…

The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privilege of the user invoking the installer.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12512] The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied…

The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12281] The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode…

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach the application, an unauthenticated attacker can log in with forged identity headers and, when automat…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15752] A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f92…

A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to…

nvdaltovulnerabilidad CVSS 7.3 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56362] A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifi…

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's periodic server tick logic. When a MoveToLevel command is sent and immediately followed by a write of OperationMode=2 (in the Pump Configuration and Control cluster), the server tick function violates the assertion `currentLevel < maxLevel`, resulting in a cr…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56363] A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, af…

A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute function used in multiple clusters (Channel, Account Login, TargetNavigator, etc.). The function lacks proper validation of the delegate pointer before dereferencing. A remote unauthenticated attacker can exploit this issue by sending a crafted read request, causing…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56364] A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, …

A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the `GetDestinationGroupId().Value()` method is called without first checking whether a value exists. This leads to a crash when an InvokeCommand is sent without initializing the destination group ID. The issue affects all versions before commit 0360cc3 (Dec 5, 2024) and leads to denial of ser…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56365] A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the …

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing logic. When an InvokeCommandRequest is sent to a nonexistent endpoint and cluster (e.g., 0x34), the code incorrectly treats the endpoint as valid due to missing checks in CodegenDataModelProvider::Invoke. This causes a VerifyOrDie failure in ProcessCommandDataIB …

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-59733] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path, allowing an authenticated user to include .. in a request such as //..//config and read, overwrite, or delet…

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-54572] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the desti…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54684] jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to writ…

jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to write attacker-controlled archive entry contents outside the intended XAPK plugin temporary unpack directory because XApkLoader resolves each entry name directly with tmpDir.resolve(fileName) after a CWD-based ZIP security check. When jadx is launched from a directory that is an ancestor of the config d…

nvdaltovulnerabilidad CVSS 7.0 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-49981] Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function all…

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

nvdaltovulnerabilidad CVSS 8.2 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-50130] Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-…

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firsta…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-48808] Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox st…

Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48337] Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code …

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48351] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48352] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD