Alertas de Seguridad de la Información

H Crítico vulnerabilidad

03/07/2026

[CVE-2026-8924] A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that byp…

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

nvdcriticovulnerabilidad CVSS 9.1 NVD

H Crítico vulnerabilidad

03/07/2026

[CVE-2026-8925] The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice…

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Crítico vulnerabilidad

03/07/2026

[CVE-2026-10536] A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dep…

A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via `CURLOPT_STREAM_DEPENDS` or `CURLOPT_STREAM_DEPENDS_E`, subsequently invokes `curl_easy_reset()`, and finally terminates the handle with `curl_easy_cleanup()`. During this final cleanup phase, libcurl attempts to access and modify an internal structure that was already freed during …

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Crítico vulnerabilidad

03/07/2026

[CVE-2026-11564] libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if …

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA material for a later transfer.

nvdcriticovulnerabilidad CVSS 9.1 NVD

H Crítico vulnerabilidad

03/07/2026

[CVE-2026-11856] Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** auth…

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/07/2026

[CVE-2026-9725] The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Ar…

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/07/2026

[CVE-2026-13768] Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user t…

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-45499] Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileg…

Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-57100] Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an au…

Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-41106] Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker …

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

A Crítico vulnerabilidad

02/07/2026

[CVE-2026-38971] ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVL…

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-52830] fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer…

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legac…

nvdcriticovulnerabilidad CVSS 9.4 NVD

N Crítico vulnerabilidad

02/07/2026

[CVE-2026-38968] ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacki…

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-59099] Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthen…

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect multiple client-side webflow execution tokens from the unauthenticated login page and perform known-plaintext analysis to decrypt the webflow …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-58466] AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthe…

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Crítico vulnerabilidad

02/07/2026

[CVE-2026-44935] Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.1…

Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2024-14037] Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attacke…

Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed image/jpeg Content-Type to bypass the absence of extension and MIME type validation, with the uploaded …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2022-50973] Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bi…

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a m…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-58455] Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows…

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-56004] A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12…

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

nvdcriticovulnerabilidad CVSS 10.0 NVD