Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16327] A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing o…

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

W Alto vulnerabilidad

21/07/2026

[CVE-2026-60137] Vulnerabilidad explotada activamente en WordPress Core

CISA confirma explotación activa de una vulnerabilidad en WordPress Core. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-08-04.

wordpressexplotación activavulnerabilidad CISA KEV

W Alto vulnerabilidad

21/07/2026

[CVE-2026-63030] Vulnerabilidad explotada activamente en WordPress Core

CISA confirma explotación activa de una vulnerabilidad en WordPress Core. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-24.

wordpressexplotación activavulnerabilidad CISA KEV

L Alto vulnerabilidad

21/07/2026

[CVE-2026-0770] Vulnerabilidad explotada activamente en Langflow Langflow

CISA confirma explotación activa de una vulnerabilidad en Langflow Langflow. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-24.

langflowexplotación activavulnerabilidad CISA KEV

D Alto vulnerabilidad

21/07/2026

[CVE-2021-27137] Vulnerabilidad explotada activamente en DD-WRT DD-WRT

CISA confirma explotación activa de una vulnerabilidad en DD-WRT DD-WRT. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-24.

dd-wrtexplotación activavulnerabilidad CISA KEV

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15903] Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacke…

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15904] Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker …

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15905] Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentia…

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15902] Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute…

Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

20/07/2026

[CVE-2026-64624] FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line opt…

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-55544] NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP c…

NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (`nxtc__...`). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and que…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-55550] NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is a…

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do n…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-47255] AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to versio…

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed ou…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-51031] FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the…

FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-16324] A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is …

A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function of the file /business/qnaire/upload.jsp. Such manipulation of the argument File leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2024-51316] The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name fun…

The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-56624] Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java librar…

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-47198] Paymenter is a free and open-source webshop solution for management of hosting services. In versions…

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurati…

nvdaltovulnerabilidad CVSS 8.5 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-56452] Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for…

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects on…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-56623] Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library…

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 …

nvdaltovulnerabilidad CVSS 7.1 NVD