Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53784] rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access file…

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to ref…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53785] rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write f…

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the d…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-49857] auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. …

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53783] rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in …

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28154] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19291] Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x imp…

Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19292] Re-pairing with a legitimate device can use a lower security level than previous making brute-forcin…

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19293] SMP security request (from peripheral) does not include the maximum encryption key size supported. U…

SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16101] Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue d…

Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-15994] During an internal security assessment, an improper link following vulnerability was identified in L…

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-14456] Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packet…

Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-12036] An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and…

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73188] Unauthenticated Sensitive Data Exposure in KiviCare <= 4.5.1 versions.

Unauthenticated Sensitive Data Exposure in KiviCare

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73346] Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66704] Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-67986] amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code …

amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application pa…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-67991] crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular…

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66697] Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCom…

Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66698] Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.

Unauthenticated Cross Site Scripting (XSS) in SureDash

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66700] Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover

nvdaltovulnerabilidad CVSS 7.1 NVD