Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-30618] xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management a…

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-30623] LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functional…

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2025-65720] An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a vi…

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-26718] A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.…

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-51380] Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a p…

Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52887] NocoBase is an AI-powered no-code/low-code platform for building business applications and enterpris…

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authen…

nvdcriticovulnerabilidad CVSS 10.0 NVD

N Crítico vulnerabilidad

15/07/2026

[CVE-2026-54052] n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, a…

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history backups were not isolated per tenant, allowing an authenticated tenant to read workflow version snapshots belonging to other tenants and delete or destro…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-49352] 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback…

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-46339] 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware d…

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

nvdcriticovulnerabilidad CVSS 10.0 NVD

C Crítico vulnerabilidad

15/07/2026

[CVE-2026-49445] Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, …

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.…

nvdcriticovulnerabilidad CVSS 9.2 NVD

O Crítico vulnerabilidad

15/07/2026

[CVE-2026-62948] OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DH…

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/sta…

nvdcriticovulnerabilidad CVSS 9.6 NVD

B Crítico vulnerabilidad

15/07/2026

[CVE-2026-53512] Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the lega…

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens …

nvdcriticovulnerabilidad CVSS 9.1 NVD

B Crítico vulnerabilidad

15/07/2026

[CVE-2026-53513] Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @bet…

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is set, store them on the ssoProvider row without origin validation, and fetch them during OIDC callb…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-14960] Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\…

Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware re…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-62378] RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until …

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, an…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52842] Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched…

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in versio…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52843] Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() …

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin reques…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-50148] Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54…

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC dri…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-44986] Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot expo…

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-61736] LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server default…

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated …

nvdcriticovulnerabilidad CVSS 9.3 NVD