Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/07/2026

[CVE-2026-44191] A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vuln…

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when ex…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65598] n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone ope…

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, exec…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-65603] The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in …

The Grav Login plugin (grav-plugin-login) versions

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65591] n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member h…

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65595] n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exch…

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations s…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65016] n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Ent…

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role (unlike the token-exchange identity path, which rejects it). An SSO-authenticated user whose instance-role claim resolves to gl…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-44189] A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider…

A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters are not properly sanitized, leading to the execution of arbitrary code with the privileges of the user running VS Code. Th…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-14551] The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.…

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running as SYSTEM, periodically monitors the directory %ProgramData%\ServerEye3\update\ for a trigger file named "update_available". Due to insufficient access restric…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-3821] Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. …

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-12968] The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not r…

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-65315] Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata …

Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata array counts that are used as allocation sizes without validation against remaining file size. Attackers …

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62567] Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). S…

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). …

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62560] Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Op…

Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). While the vulnerability is in Oracle HRMS (Norway), attacks may significantly impact additional produ…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62515] Vulnerability in the Oracle Advanced Planning Command Center product of Oracle E-Business Suite (com…

Vulnerability in the Oracle Advanced Planning Command Center product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Planning Command Center. While the vulnerability is in Oracle Advanced Planning Command…

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62456] Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operat…

Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle HRMS (UK). While the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scop…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-61324] Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Interna…

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. While the vulnerability is in Oracle Advanced Benefits, attacks may significantly impact additiona…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-61325] Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Interna…

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. While the vulnerability is in Oracle Advanced Benefits, attacks may significantly impact addition…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-61312] Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Oper…

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products …

nvdaltovulnerabilidad CVSS 8.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-61240] Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft…

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eSettlements). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise FIN Common Objects Argentina executes to compromise…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-61224] Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communicat…

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with network access via TLS to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged…

nvdaltovulnerabilidad CVSS 8.0 NVD