Alertas de Seguridad de la Información

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47036] Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval…

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager). Supported versions that are affected are 17.0-26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Bas…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47040] Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions th…

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this vulnerability can result in unauthorized access to critical data or comp…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47019] Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog)…

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-46999] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in u…

nvdaltovulnerabilidad CVSS 7.0 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47004] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in tak…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46992] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-50759] An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /stat…

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47393] PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that Praison…

PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that PraisonAI ships a code-generator (`praisonai.deploy.api.generate_api_server_code`) that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart (`praisonai deploy --type api`) get a server that binds to `0.0.0.0` per the recommended sample YAML, exposes …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47396] PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a …

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since eve…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47391] PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server…

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a `calculate(expression)` tool implemented with Python `eval()`. The example also binds to `0.0.0.0`. A remote unauthenticated attacker can send `message/send` to `/a2a`; the request reaches `agent.chat()`, and a real LLM can in…

nvdcriticovulnerabilidad CVSS 9.8 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-55626] xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session …

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active d…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-46555] WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read a…

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these i…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-63429] HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authe…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoi…

nvdaltovulnerabilidad CVSS 8.6 NVD

S Alto vulnerabilidad

20/07/2026

[CVE-2026-63757] SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessio…

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-16242] A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent…

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy,…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16210] A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_acti…

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16209] A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function o…

A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Ap…

nvdaltovulnerabilidad CVSS 7.3 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-8505] IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic…

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the ow…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-9103] IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due …

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-9202] IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user acco…

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.

nvdcriticovulnerabilidad CVSS 9.8 NVD