Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/07/2026

[CVE-2026-53657] Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on…

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addre…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-1667] The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Sto…

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to create arbitrary posts, and, if the Advanced Custom Fields plugin is installed and acti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2025-70796] An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wirel…

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web root directory. This may allow disclosure of sensitive system files and configuration data

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-55500] 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows f…

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-54149] MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import function…

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing mode in apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file containing stdio transport with malicious commands and trigg…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

10/07/2026

[CVE-2026-33382] Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request bo…

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-15143] A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allow…

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-61444] PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the a…

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56279] Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RP…

Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-29519] Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflect…

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that i…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-38057] The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication…

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate devi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-22660] FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows auth…

FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a type mismatch in the bulk delete protection check. The bulk AJAX endpoint in the management views compares received JSON integer group IDs against string literals, causing the protection check to always pass, which …

nvdaltovulnerabilidad CVSS 7.2 NVD

D Alto vulnerabilidad

10/07/2026

[CVE-2026-54469] Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untruste…

Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-15378] A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacke…

A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-40007] Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_a…

Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-12685] The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscat…

The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who supplies a hard-coded, per-build key permanently delete all of the site's content, and that covertly transmits the site URL, administrator email address, and license key to a third-party server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15298] The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions u…

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for unauthenticated attackers to inject malicious scripts via Telegram chat titles that execute when an administrator…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15330] A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_ima…

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-54423] In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI ma…

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15319] A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function…

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file web/backend/middleware/access_control.go of the component Launcher. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 3126. A patch should be applied…

nvdaltovulnerabilidad CVSS 7.3 NVD