Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/07/2026

[CVE-2026-46923] Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Su…

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). While the vulnerability is in Oracle Public Sector…

nvdaltovulnerabilidad CVSS 8.0 NVD

Z Alto vulnerabilidad

21/07/2026

[CVE-2026-10678] The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes …

The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive bu…

nvdaltovulnerabilidad CVSS 8.1 NVD

Z Alto vulnerabilidad

21/07/2026

[CVE-2026-10680] The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/…

The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command size against buf->len (the bytes remaining in the whole received PDU) instead of len (the per-command data length from the L2CAP signaling header). Because multiple signaling commands can be packed into one PDU, buf->len may exceed a co…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16484] A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vuln…

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-63358] FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the…

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-63764] LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vuln…

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An unauthenticated attacker can submit a crafted image_url to the chat completions endpoint pointing to an att…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-64881] The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow int…

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47690] MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions o…

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-52469] SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via t…

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-52470] SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via t…

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-52472] SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the…

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-30631] An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11…

An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-44878] A vulnerability in the web-based management interface of an ECOS device could allow a highly privile…

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete system data.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-44879] A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authe…

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-64878] Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument …

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-64879] A filename supplied during file upload is not properly sanitized before being used in system command…

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-59145] Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot,…

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find. The attach-time validator si_validate_header is thorough about the header and layout (magic, version, section offsets, total_size, count and arena_used) but does not validate the three arrays it then trusts. Every lookup in si_idx_find walks a triple indir…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-59147] Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an …

Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu_find. The attach-time validator dsu_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. dsu_find walks and path-compresses parent[x] with x a raw file-stored index never bounded a…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-50758] Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to…

Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-50759] An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /stat…

An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication.

nvdaltovulnerabilidad CVSS 7.5 NVD