Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17568] Improper access control in the role membership management endpoint in Devolutions Server allows an a…

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66729] facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body …

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66730] facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser…

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66731] facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked tran…

facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding: chunked header containing a leading minus sign in the chunk size field, causing the parser in http1_parser.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-63077] In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible …

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-24252] NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A s…

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-17191] An input validation vulnerability exists in an API component of the orchestrator. An authenticated u…

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not awa…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17192] A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on …

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer net…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-66395] SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar p…

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66396] SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Ga…

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66394] SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanit…

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, e…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2025-50455] SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Al…

SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66050] NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer se…

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66427] Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

Administrator SQL Injection in WP Google Review Slider

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-59550] Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.

Unauthenticated SQL Injection in AWP Classifieds

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59551] Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59552] Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &amp; Embedder <= 1.4.2…

Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &amp; Embedder

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59553] Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59556] Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <=…

Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59558] Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Booking Calendar

nvdaltovulnerabilidad CVSS 7.1 NVD