Alertas de Seguridad de la Información

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-64825] Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthentica…

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.__truediv__ …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47392] PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to vers…

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `execute_code()` in `praisonaiagents/tools/python_tools.py` (v1.6.37, subprocess sandbox mode) can be fully bypassed using `print.__self__` to retrieve the real Python `builtins` module, from which `__import__` can be extracted via `vars()` and runtime string construct…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47393] PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that Praison…

PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that binds to `0.0.0.0` per the recommended sample YAML, exposes …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47396] PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a …

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since eve…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47391] PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server…

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can in…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28317] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28321] SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary fi…

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28312] SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s …

SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28313] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28314] SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an …

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28316] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28304] SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can all…

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28305] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28306] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administr…

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28307] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user grou…

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28308] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28309] SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administ…

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28310] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administr…

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28302] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65048] Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored c…

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a …

nvdcriticovulnerabilidad CVSS 9.3 NVD