Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/07/2026

[CVE-2026-12357] Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability.…

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the generateFileContent function. The issue results from the lack of proper neut…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-14266] 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerab…

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-16655] The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin fo…

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-23904] Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to th…

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0. Users are recommended to upgrade to version 1.1…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14893] IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer comp…

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-57510] SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasSer…

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads contain…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-49258] Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and belo…

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web read/mutation surface. Any authenticated non-admin operator (for example, one created via self-registration …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48390] Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escala…

Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48391] Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code exe…

Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48392] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48393] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48394] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48395] Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code exe…

Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48396] Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code e…

Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48374] Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversa…

Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-18107] A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A mal…

A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs. The …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48372] Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitr…

Format Plugins is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48388] Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that cou…

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running t…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-67185] TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers …

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse() without normalization, dot-segment removal, or boundary checks. Attackers can craft a single request with ../ sequences that pass through th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-67182] Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote atta…

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers can craft a header value containing a complete additional HTTP request that is interpreted as a sepa…

nvdaltovulnerabilidad CVSS 7.5 NVD