Alertas de Seguridad de la Información

C Alto vulnerabilidad

23/06/2026

[CVE-2026-52844] Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy …

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private/*, but file_server later resolves the same request path as private\secret.txt on disk. An unauthenticated remote client can bypass Caddy path-scoped auth/deny routes protecting /private/*. This vulnerability is fixed in 2.11.4.

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

23/06/2026

[CVE-2026-52845] Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_…

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the…

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

23/06/2026

[CVE-2026-49401] Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system…

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system enforces filesystem and execution restrictions by comparing the requested path against the path supplied to --deny-read, --deny-write, --deny-run, or --deny-ffi. On macOS, that comparison was done at the raw-byte level while the APFS filesystem treats different Unicode spellings of the same name as…

nvdaltovulnerabilidad CVSS 7.3 NVD

C Alto vulnerabilidad

23/06/2026

[CVE-2026-45135] Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCG…

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or ot…

nvdaltovulnerabilidad CVSS 8.1 NVD

B Alto vulnerabilidad

23/06/2026

[CVE-2026-56115] Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low…

Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by exploiting missing role enforcement in the JWTMiddleware function in internal/auth/auth.go, which validates JWT tokens and account status but fails to inspect the is_admin flag. Attackers can send requests to any endpoint under the /api/users pa…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

23/06/2026

[CVE-2026-55446] Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an a…

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54308] n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent36…

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. This vulnerability is fixed in 2.25.7 and 2.26.2.

nvdaltovulnerabilidad CVSS 7.2 NVD

L Alto vulnerabilidad

23/06/2026

[CVE-2026-33760] Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langf…

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perform read, write, and delete operations on user-owned resources — messages, sessions, build artifacts, and LLM transaction logs — without verifying that the authenticated requester owns the targeted resource. Any authenticated user can read, m…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

23/06/2026

[CVE-2026-56275] Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node t…

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud metadata, and enumerate internal services by exploiting the missing secureFetch verification in httpSecurity…

nvdaltovulnerabilidad CVSS 7.1 NVD

T Alto vulnerabilidad

23/06/2026

[CVE-2023-54365] Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 req…

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56324] Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that a…

Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attackers to circumvent rate limiting by rotating the user-controlled device_id parameter. Attackers can send multiple requests per second by changing device_id values to flood the channel_devices table and cause database exhaustion.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56323] Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_…

Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that allows unauthenticated attackers to enumerate non-public channel names and determine app existence and subscription status. Remote attackers can send GET requests with arbitrary app_id parameters to disclose internal rollout channels, enumerate valid applications across tenants, a…

nvdaltovulnerabilidad CVSS 7.5 NVD

K Alto vulnerabilidad

22/06/2026

[CVE-2026-56266] Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/str…

Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supplied URLs without validation. Unauthenticated attackers can bypass the internal-address blocklist using IPv6-mapped IPv4 addresses to reach internal services and cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 8.6 NVD

C Alto vulnerabilidad

22/06/2026

[CVE-2026-55603] http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequest…

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54299] Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 …

Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-53779] WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthe…

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows f…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

22/06/2026

[CVE-2026-55602] http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, …

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+pat…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-54290] Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.…

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to a…

nvdaltovulnerabilidad CVSS 7.1 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54275] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have bee…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54277] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS…

nvdaltovulnerabilidad CVSS 7.5 NVD