Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-46339] 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware d…

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-14960] Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\…

Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware re…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-62378] RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until …

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, an…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52842] Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched…

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in versio…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52843] Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() …

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin reques…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-44986] Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot expo…

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-61736] LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server default…

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-43637] Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to writ…

Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loader…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-61451] The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-suppli…

The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitrary host. As a result, an unauthenticated attacker c…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-56699] Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSea…

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-5269] In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden sys…

In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-5270] An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control…

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-51807] Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions …

Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are written to j2k_codeblock::pass_length[128]. A crafted JPEG 2000 codestream containing malformed PPM packet headers can trigger a heap-based out-of-bounds write in j2k_precinct_subband::parse_pack…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-51808] Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitra…

Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded function in source/core/interface/decoder.cpp

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-45363] ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and…

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_fi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-38450] An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitra…

An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameter of the Add/Update Project function

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-52101] An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensit…

An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-53486] The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction…

The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction can create files and links outside the target directory. When extracting an archive to a directory, a crafted archive can read or write files outside that directory because hardlink and symlink entries are created without checking where targets point, path containment used a string prefix compariso…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-53633] Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vite…

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-47428] Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Brow…

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in ve…

nvdcriticovulnerabilidad CVSS 9.6 NVD