Alertas de Seguridad de la Información

M Alto vulnerabilidad

31/07/2026

[CVE-2026-12720] The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when i…

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress v…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-63223] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload valid…

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads u…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-63221] CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch()…

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed i…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-63222] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without …

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56672] ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file}…

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflows, and authenticated-equivalent API calls. The handler used web.FileResponse(path), so an uploaded .h…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56673] ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to…

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated crafted POST /prompt workflow using LoadImage or sibling nodes to probe arbitrary host paths and exfilt…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56671] ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2…

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to use traversal, encoded traversal, absolute paths, or an unbounded path_index to read image-decodable f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56670] ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2…

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripting in the ComfyUI origin. This issue is fixed in version 0.28.0.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-55502] Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/p…

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth token without Admin.Write to modify storage policy credentials. The route is inside the admin group that requires Admin.Read, but it does not …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-43832] Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-43830] Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-43831] Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-43829] Full details and mitigation steps are currently restricted and will be published at a later date.

Full details and mitigation steps are currently restricted and will be published at a later date.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-18157] A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the s…

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-66360] The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mod…

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This condition occurs before MMS session establishment, a crafted TCP/102 connection attempt can trigger the …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-66420] MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that al…

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of th…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66421] OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated …

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute with…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-63035] A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an …

A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-65423] An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a …

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-62246] Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a Te…

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or dest…

nvdaltovulnerabilidad CVSS 8.5 NVD