Alertas de Seguridad de la Información

H Crítico vulnerabilidad

03/07/2026

[CVE-2026-8927] When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configur…

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-45499] Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileg…

Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-57100] Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an au…

Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2024-14037] Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attacke…

Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed image/jpeg Content-Type to bypass the absence of extension and MIME type validation, with the uploaded …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2022-50973] Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bi…

Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a m…

nvdcriticovulnerabilidad CVSS 9.8 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-55115] A malicious actor with access to the network and low privileges could exploit a Server-Side Request …

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

H Crítico vulnerabilidad

01/07/2026

[CVE-2026-50160] Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from ve…

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped …

nvdcriticovulnerabilidad CVSS 10.0 NVD

F Crítico vulnerabilidad

01/07/2026

[CVE-2026-14198] @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter valu…

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorizatio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

U Crítico vulnerabilidad

01/07/2026

[CVE-2026-7840] UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administrat…

UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-56415] Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl scri…

Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges on the underlying system.

nvdcriticovulnerabilidad CVSS 10.0 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-10140] IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows…

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-58172] Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability tha…

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream servi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

F Crítico vulnerabilidad

30/06/2026

[CVE-2026-6556] @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount path…

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authen…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

29/06/2026

[CVE-2026-13762] Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow…

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was remediated server-side. No customer action is required.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

29/06/2026

[CVE-2026-13763] Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled…

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2 ALB target groups. To remediate this issue, customers should enable the "Insp…

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Crítico vulnerabilidad

29/06/2026

[CVE-2026-11720] A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When …

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL …

nvdcriticovulnerabilidad CVSS 9.1 NVD

J Crítico vulnerabilidad

28/06/2026

[CVE-2026-49048] The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by …

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

K Crítico vulnerabilidad

26/06/2026

[CVE-2026-49869] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, Authentic…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated r…

nvdcriticovulnerabilidad CVSS 10.0 NVD

K Crítico vulnerabilidad

26/06/2026

[CVE-2026-53576] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authe…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace},…

nvdcriticovulnerabilidad CVSS 10.0 NVD

B Crítico vulnerabilidad

26/06/2026

[CVE-2026-54350] Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any p…

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write query, modifies every document of that collection with one HTTP request. enrichContext at packages/server…

nvdcriticovulnerabilidad CVSS 10.0 NVD