Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/07/2026

[CVE-2026-60005] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the …

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability m…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-55242] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-47158] Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO aut…

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact after failed token exchange, allowing an unauthenticated attacker to induce IdP authentication and red…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-47164] Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO log…

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-45805] Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP'…

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot MCP's mcp/packages/server/src/ReplServer.ts bound the ReplServer to 0.0.0.0:4403 and exposed an unauthenticated /execute endpoint that passed the code field to PluginBridge.executePluginTask(), allowing anyone on the network to execute JavaScript on the server. This issue is fixed in version 2.15.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-45806] Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's re…

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in backend/src/app/rpc/commands/media.clj, where media/download-image in backend/src/app/media.clj used the shared HTTP client without …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61644] FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api…

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat and collection context, but the initialId center-node lookup is not bound to that authorized context. A low-privileged tenant user can call the endpoint with valid attacker-owned appId, chatId, chatItemDataId, and collecti…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59762] When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase…

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.   Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-54563] Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV a…

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the con…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-54560] Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's…

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as fi…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-42533] A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching …

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyon…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-58558] Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnera…

Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15809] A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allow…

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61873] Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.f…

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to write arbitrary files including PHP webshells to …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61457] The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass i…

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension() inspects only the final file extension via pathinfo($filename, PATHINFO_EXTENSION), so a user with api.media.write permission can upload a file with a double extension such as shell.php.jpg to bypass the dangerous extensions bl…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61443] PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_scrip…

PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61446] PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plug…

PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file t…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61427] PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the…

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream' without an API key, an unauthenticated client (no Authorization header, and no Origin header, which is a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61430] PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool t…

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61433] PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Pytho…

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agents_file configuration parameters that execute when the generated server starts or handles requests.

nvdaltovulnerabilidad CVSS 7.8 NVD