Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/07/2026

[CVE-2026-11622] A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone ca…

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the `max-cache-size` parameter. This issue affects BIND 9 versions 9.11.0 through 9.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-12617] The issue is unexpected program termination based on ordering and/or specific content in responses t…

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, `named` may quit unexpectedly. Or, if …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-62144] An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security …

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a conf…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-62145] A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Port…

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-32665] In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enab…

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Un…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13185] In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in R…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13186] In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-b…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13187] In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tam…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13189] In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language para…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13190] In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persi…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13181] In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUp…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13182] In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can d…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13183] In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing ma…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13184] In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is …

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-44191] A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vuln…

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and ansible.executionEnvironment.volumeMounts settings, allowing an attacker to inject shell separators. This can be triggered automatically during Language Server initialization or manually when ex…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65598] n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone ope…

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted repository in the community node directory, which n8n loads as a custom node on the next restart, exec…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65591] n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member h…

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legacy expression engine is the default in affected versions. Fixed in n8n 1.123.64, 2.29.8, and 2.30.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65595] n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exch…

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a configured issuer can use the resulting access token to invoke administrator-only Public API operations s…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65596] n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restrict…

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a cr…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65015] n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature whe…

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

nvdaltovulnerabilidad CVSS 8.8 NVD