Alertas de Seguridad de la Información

C Alto vulnerabilidad

29/07/2026

[CVE-2026-20316] Vulnerabilidad explotada activamente en Cisco Secure Firewall Management Center (FMC)

CISA confirma explotación activa de una vulnerabilidad en Cisco Secure Firewall Management Center (FMC). No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-08-01.

ciscoexplotación activavulnerabilidad CISA KEV

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-62325] goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2…

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-64863] goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, th…

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54719] goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, th…

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauthenticated reads of files protected only by .goshs folder ACLs and block lists. This issue is fixed in version 2.1.1. This vulnerability exists due to an incomple…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54638] gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode …

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage colle…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54650] openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in …

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/public_proxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath(), allowing percent encoded dot segments %2e and separators %2f to reach tunneled local services as ../ and / for path traversal. This issue is fixed in version 0.1.2.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-54658] Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/c…

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.0.2, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closing quote and inject arbitrary SQL. This issue is fixed in version 2.0.2.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-47219] find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports ro…

find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards. Versions prior to 9.7.0 are vulnerable to remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The lookup() function passes req.method into find(), and find() indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method va…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-55390] datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.6…

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodel_code_generator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside the input base path, allowing arbitrary local files to be read and reflected into generated models. T…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-55391] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodel_code_generator/http.py through get_body, _validate_url_for_fetch, and _get_ips_from_host, but then lets httpx resolve the host again for …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-55415] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling thr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54653] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits the…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54654] datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.6…

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_gene…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54655] datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.6…

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is importe…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54656] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decora…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54691] datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61…

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodel_code_generator/http.py http.get_body accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private, link-local, metadata, and other network-accessible resources. This issue is fixed in version 0.61.0.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14996] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session manageme…

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14958] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute ar…

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14959] IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute ar…

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14974] IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute a…

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

nvdaltovulnerabilidad CVSS 8.1 NVD