Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en Home Assistant Companion permite ejecución de acciones por aplicaciones no autorizadas

Home Assistant Companion (versiones anteriores a 2026.5.3) no valida correctamente las aplicaciones que envían enlaces de etiquetas NFC o QR a través del sistema operativo, permitiendo que cualquier aplicación no confiable en el dispositivo ejecute acciones arbitrarias en la plataforma de automatización. Esto compromete la privacidad y seguridad local de hogares inteligentes en México y Latinoamérica que dependen de este software de código abierto.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica en Kata Containers permite ejecución de código en el host

Kata Containers anterior a versión 4.0.0 es vulnerable a ejecución de código en el host mediante anotaciones de configuración sin validar. Un atacante puede especificar una ruta TOML arbitraria a través de la anotación io.katacontainers.config_path para cargar archivos maliciosos del host. Esta vulnerabilidad afecta infraestructuras containerizadas en datacenters y plataformas cloud de empresas LATAM que ejecuten orquestación con Kubernetes.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-61808] LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRA…

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources. This issue is mitiga…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62295] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62296] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-48039] Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to…

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authenticatio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-15972] Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthentic…

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-71851] crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate…

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained present in nearly every 3.x release…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-48097] NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a use…

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on executable resolution through the `PATH` environment variable. An attacker controlling the execution environment can place malicious executables such as sudo ea…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-48098] NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a use…

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using `sudo` and `shell=True` directly inside application logic. In environments where passwordless sudo (`NOPASSWD`) is enabled, privileged commands may execute silently without explicit user confirmation. Version 2.0.0 fixe…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19231] A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vu…

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2025-71409] Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to in…

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-64636] An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authe…

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-64637] Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated re…

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19082] Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-…

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-71556] go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alp…

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-68772] ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component…

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands wh…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-20345] A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attac…

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerab…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-20346] A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attac…

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-20347] A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote at…

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-O files during scanning, which may result in an out-of-bounds buffer read. An attacker could ex…

nvdaltovulnerabilidad CVSS 7.5 NVD