Alertas de Seguridad de la Información

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-48753] Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upl…

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-16926] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary f…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-49441] Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4…

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json. The destination is joined to WAZUH_PATH without proving that it remains inside the directory selected by …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-48162] Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4…

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmp_file value to WAZUH_PATH without canonicalization or confinement. A cluster peer holding the shared Fernet key can use traversal or an absolute path to make…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-20358] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20358 are related to external control of the file system issues tha…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-53451] Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and…

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to backend/server/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-75913] CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection …

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an at…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-17184] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due t…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72841] luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowin…

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72842] luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated Lu…

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-17482] IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary cod…

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-16054] The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not preven…

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-52680] Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when …

Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to write controlled content outside the intended upload directory, subject to filesystem permissions. Thi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-67429] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.dow…

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-50148] Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54…

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC dri…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-57898] In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments usin…

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter and passed it through repository file handling as both a repository key and, during thumbnail retri…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-14480] OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web U…

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the destination path for an uploaded file without validating or restricting the path. Because Python os.path.join() honors attac…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-6070] The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deleti…

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is acce…

nvdcriticovulnerabilidad CVSS 9.1 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71333] Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1…

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71334] Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnera…

Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToSt…

nvdcriticovulnerabilidad CVSS 9.8 NVD