Alertas de Seguridad de la Información

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64024] In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_i…

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the produce…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63979] In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pin…

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63978] In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending re…

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to list_splice_init() in handshake_net_exit() are reversed. The call moves the local empty "requests" list onto hn->hn_requests, leaving the local list empty, so the subsequent drain loop runs zero iterations. Pending handshake requests that had not yet be…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63938] In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request ind…

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Check PSC request indices against the actual size of the buffer When processing Page State Change (PSC) requests, validate the PSC buffer against the effective size of the scratch area, which could be less than the maximum size if the guest provided a pointer that isn't exactly at the start of the GHCB shared buffer.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63940] In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O reque…

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port I/O requests of length '0' Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0.

nvdcriticovulnerabilidad CVSS 9.3 NVD

L Crítico vulnerabilidad

19/07/2026

[CVE-2026-63795] In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_…

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even thou…

nvdcriticovulnerabilidad CVSS 10.0 NVD

F Crítico vulnerabilidad

18/07/2026

[CVE-2026-16117] Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix w…

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefi…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-54159] PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4…

PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unseri…

nvdcriticovulnerabilidad CVSS 10.0 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-8859] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to u…

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HTTP response Content-Disposition headers are not sanitized before being joined to the temporary director…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2024-23564] HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the …

HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verify the validity of the provided UserId, but similar validation is not applied to Email requests when sen…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/07/2026

[CVE-2026-63087] Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote a…

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

N Crítico vulnerabilidad

16/07/2026

[CVE-2026-45568] zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Pyth…

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing requests.request to return a server-side response from an attacker-chosen URL. This issue is fixed in v…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/07/2026

[CVE-2026-45695] Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, c…

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-55652] Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED…

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fix…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-26718] A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.…

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52843] Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() …

Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() and XMLHttpRequest unconditionally attached session cookies to every HTTP request, ignoring credentials: omit, credentials: same-origin, credentials: include, and XMLHttpRequest.withCredentials, allowing an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin reques…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-61736] LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server default…

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-56699] Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSea…

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin credentials, enabling document deletion, alert tampering, and cross-agent SIEM state manipulation.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-5270] An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control…

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48259] Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that coul…

Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not re…

nvdcriticovulnerabilidad CVSS 9.6 NVD