Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/07/2026

[CVE-2026-5056] GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerabilit…

GStreamer qtdemux Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of UncompressedFrameConfigBox …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-5057] ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability a…

ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RpcProvider class. The issue results from the lack of authentication prior to allowing access to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-5487] DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote…

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a us…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-5490] DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attacke…

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied string befo…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-18022] Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write d…

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-12357] Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability.…

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specific flaw exists within the generateFileContent function. The issue results from the lack of proper neut…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-13268] G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This v…

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Backup Service. By…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67428] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emit…

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, a…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67201] V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulne…

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67424] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP …

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial URL, then follow redirects with allow_redirects=True and without per-hop Location revalidation, allowing…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67425] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat …

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67427] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workf…

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-16328] In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was…

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an attacker-controlled endpoint, potentially exfiltrating the Consul token configured on the server. This v…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-40272] Improper Input Validation in the decode() function of the traceparser library could allow an attacke…

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-14266] 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerab…

7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54727] proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restor…

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in ver…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64558] In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey…

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in pkey_pckmo handler implementation Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64559] In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY…

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Check length in PKEY_VERIFYPROTK ioctl Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64560] In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF c…

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54574] proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro instal…

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through _extract_plain_tar() in proot_distro/commands/install.py and Docker layers through _apply_layer() in proot_distro/helpers/docker.py without validating archive-controlled symlink targets in member.linkname, allowing a malicious archive to plant an ab…

nvdaltovulnerabilidad CVSS 8.2 NVD