Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76139] A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a s…

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to u…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-75569] A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remot…

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to t…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-62680] Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specificat…

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-73367] Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-6464] Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit executio…

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18408] Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server …

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient fo…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-54981] Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension al…

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15560] when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs …

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-55522] PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12…

PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 through 1.6.57 of praiseonaiagents, the workflow "include" feature is vulnerable to code execution. Workflow._execute_include() implicitly imports and runs an included recipe's tools.py via a raw importlib.util.spec_from_file_location() and spec.loader.exec_module() call, without honoring the PRAIS…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-67623] Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to e…

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66141] Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport i…

Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65908] In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executabl…

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open

nvdaltovulnerabilidad CVSS 8.6 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64806] In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr…

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

nvdaltovulnerabilidad CVSS 8.4 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64807] In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied lin…

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

nvdaltovulnerabilidad CVSS 7.8 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64808] In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project tr…

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling

nvdaltovulnerabilidad CVSS 8.4 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64809] In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project tr…

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter

nvdaltovulnerabilidad CVSS 8.4 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64811] In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting proje…

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

nvdaltovulnerabilidad CVSS 7.8 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64804] In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr…

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

nvdaltovulnerabilidad CVSS 8.4 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64805] In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr…

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47398] PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-443…

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a mod…

nvdaltovulnerabilidad CVSS 8.1 NVD