Alertas de Seguridad de la Información

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-59543] Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.

Subscriber Remote Code Execution (RCE) in Advanced Views

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15011] The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection v…

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to d…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-16606] A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before v…

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-21575] This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sou…

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user inte…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47398] PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-443…

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to the tool_override.py sinks. However, two additional spec.loader.exec_module call sites in praisonai/agents_generator.py were missed and remain completely unguarded in versions prior to 4.6.40. Both functions accept a mod…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65008] Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData…

Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData() (system/src/Grav/Common/Data/Blueprint.php), which passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with the admin.pages (or api.pages.writ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-52656] An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C an…

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-44359] Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtast…

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_ass…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-9147] uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and …

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source without safe quoting via repr() or the !r format specifier. An attacker who can supply a crafted ROOT file can place Python expression-breakin…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47867] VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with netwo…

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47869] VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated u…

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 8.7 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-8635] IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser…

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

nvdcriticovulnerabilidad CVSS 9.9 NVD

L Alto vulnerabilidad

17/07/2026

[CVE-2026-8056] IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at…

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-8481] IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the …

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system comman…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-52199] An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar…

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-9135] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163…

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["…

nvdcriticovulnerabilidad CVSS 9.9 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-9198] IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (…

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

nvdcriticovulnerabilidad CVSS 9.8 NVD

I Alto vulnerabilidad

17/07/2026

[CVE-2026-9762] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when…

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/07/2026

[CVE-2026-46512] Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply ac…

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template parameters including greeting, dest, url, extension, code, and file, and Tools/DialplanApply.php wrote Dialplan/Templates.php output to extensions_custom.conf while only Dialplan/TemplateBase.php:38-42 sanitized contextName(), allowing a PERM_WRITE caller using confirm:true to inject…

nvdcriticovulnerabilidad CVSS 9.9 NVD

S Crítico vulnerabilidad

16/07/2026

[CVE-2026-46621] Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python…

Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm's logic through the missio…

nvdcriticovulnerabilidad CVSS 9.1 NVD