Alertas de Seguridad de la Información

L Alto vulnerabilidad

17/07/2026

[CVE-2026-7754] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) …

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.

nvdaltovulnerabilidad CVSS 7.7 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-50289] systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterf…

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces() on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive because lib/network.js checkLinuxDCHPInterfaces() reads /etc/network/interfaces, extracts a source token from file content, and interpolates it unquoted into cat ${file} 2> /dev/null…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

17/07/2026

[CVE-2026-13448] IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution …

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgen…

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

17/07/2026

[CVE-2026-14499] IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrar…

IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-9103] IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due …

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-9135] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163…

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["…

nvdcriticovulnerabilidad CVSS 9.9 NVD

L Alto vulnerabilidad

16/07/2026

[CVE-2026-62290] cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and…

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selecte…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

16/07/2026

[CVE-2026-45695] Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, c…

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

16/07/2026

[CVE-2026-53366] In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on th…

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb ar…

nvdaltovulnerabilidad CVSS 7.8 NVD

O Crítico vulnerabilidad

15/07/2026

[CVE-2026-62948] OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DH…

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/sta…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61835] Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, th…

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts treats 0.0.0.0 as a keyword for local interfaces but never blocks the literal address itself. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-52100] Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a …

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-52101] An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensit…

An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-24229] NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, …

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-24233] NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model we…

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 8.4 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15777] Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who…

Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15769] Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior …

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15764] Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker …

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50651] Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny…

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50524] Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to …

Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD