Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-54458] WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site…

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a sign…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52891] Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embe…

Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child_process.exec() for MIME-type detection. Because models/avatars.js and models/fileValidation.js used a shell command with the avatar filename, shell metacharacters such as backticks and $() in the filename could execute commands on the serve…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-30618] xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management a…

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in execution of arbitrary commands on the server. Successful exploitation allows arbitrary command e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-30623] LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functional…

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2025-65720] An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a vi…

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-26718] A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.…

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-51380] Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a p…

Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52887] NocoBase is an AI-powered no-code/low-code platform for building business applications and enterpris…

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authen…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-49352] 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback…

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-46339] 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware d…

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

nvdcriticovulnerabilidad CVSS 10.0 NVD

C Crítico vulnerabilidad

15/07/2026

[CVE-2026-49445] Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, …

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.…

nvdcriticovulnerabilidad CVSS 9.2 NVD

O Crítico vulnerabilidad

15/07/2026

[CVE-2026-62948] OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DH…

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/sta…

nvdcriticovulnerabilidad CVSS 9.6 NVD

B Crítico vulnerabilidad

15/07/2026

[CVE-2026-53512] Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the lega…

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession of the bound refreshToken row and matching client_id, without verifying the confidential client's client_secret, allowing an attacker with a valid refresh_token to mint access tokens …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-14960] Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\…

Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware re…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-62378] RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until …

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, an…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52842] Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched…

Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched for @ across the entire URL string instead of only the authority component when computing a page origin, so a URL such as `http://attacker.com/@victim.com/` was fetched from attacker.com but treated as `http://victim.com`, allowing a complete Same-Origin Policy bypass. This issue is fixed in versio…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52843] Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() …

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin reques…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-50148] Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54…

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remote code execution on the Metabase server by configuring a Snowflake connection to an attacker-controlled server, because a flaw in the Snowflake JDBC dri…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-44986] Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot expo…

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-43637] Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to writ…

Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loader…

nvdcriticovulnerabilidad CVSS 9.1 NVD