Alertas de Seguridad de la Información

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47391] PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server…

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can in…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28321] SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary fi…

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28312] SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s …

SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28316] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28304] SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can all…

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28305] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28308] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28302] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65048] Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored c…

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65049] Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorizat…

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_a…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16406] Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thund…

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16407] Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153…

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16408] Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153…

Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16410] JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox …

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16411] Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption a…

Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16412] Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence…

Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16402] Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 an…

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16389] Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerabilit…

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16390] Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153,…

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16392] JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox …

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.1 NVD