Alertas de Seguridad de la Información

S Alto vulnerabilidad

14/07/2026

[CVE-2026-15409] Vulnerabilidad explotada activamente en SonicWall SMA1000 Appliances

CISA confirma explotación activa de una vulnerabilidad en SonicWall SMA1000 Appliances. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-17.

sonicwallexplotación activavulnerabilidad CISA KEV

S Alto vulnerabilidad

14/07/2026

[CVE-2026-15410] Vulnerabilidad explotada activamente en SonicWall SMA1000 Appliances

CISA confirma explotación activa de una vulnerabilidad en SonicWall SMA1000 Appliances. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-17.

sonicwallexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

13/07/2026

[CVE-2026-58101] Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer derefer…

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds. A caller inv…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57856] Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/…

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathN…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

13/07/2026

[CVE-2026-62240] CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url functi…

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61458] PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoi…

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any push-level defense, making short or dictionary-derived passphrases practically recoverable within hours o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-62184] luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IP…

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-51539] A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running …

A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout management during network read operations.

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-15685] Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnera…

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-39042] An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.…

An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15597] A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. T…

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /edit_exam2.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15680] Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerabil…

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of JSON requests in the sonia binary. Th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-55771] CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained …

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and f…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-49970] Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() fu…

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination(). Attackers can exploit the permissive character-class regex that allows both dot and slash characters combined with an ineffective trailing trim(…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2025-45869] LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (…

LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61463] Shiori contains a privilege escalation vulnerability in the account update endpoint that allows auth…

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

13/07/2026

[CVE-2026-57432] Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-boun…

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-59521] Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-fr…

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57715] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57697] Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid pro…

Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through

nvdaltovulnerabilidad CVSS 7.5 NVD