Alertas de Seguridad de la Información

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53369] In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with ov…

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, whi…

nvdaltovulnerabilidad CVSS 8.4 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53368] In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency ca…

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows: create & write & fsync 'file A' write checkpoint - f2fs_do…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16210] A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_acti…

A vulnerability was found in newpanjing simpleui 2026.01.13. This affects the function self.get_action of the file simpleui/admin.py of the component AjaxAdmin AJAX Endpoint. Performing a manipulation results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16209] A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function o…

A vulnerability has been found in Gerapy up to 0.9.13. The impacted element is an unknown function of the file gerapy/server/core/views.py of the component Project Upload Endpoint. Such manipulation leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is bd4891c60315f17611a3b7a651ffe0fba7cfe71e. Ap…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16200] A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_in…

A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the component RPC Handler. The manipulation leads to incorrect authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-10130] QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to…

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-12228] A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint o…

A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-controlled `prompt_content` into `DBDirectMessage.content` without server-side sanitization. When a victim opens the direct message (DM) thread, the message is rendered by the DM UI through `MessageContentRenderer`, which uses `v-html`…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16152] A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an un…

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16154] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affect…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_room1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

P Alto vulnerabilidad

18/07/2026

[CVE-2026-53994] ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The …

ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16128] A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receive…

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the p…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16126] A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function h…

A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the component Swarm RPC Receiver. This manipulation causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem ear…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16127] A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get…

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the component http_request. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The exploit is publicly available and might be used. The project was informed of the problem early thro…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16125] A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_n…

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem earl…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-9323] The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in…

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes…

nvdaltovulnerabilidad CVSS 8.1 NVD

F Crítico vulnerabilidad

18/07/2026

[CVE-2026-16117] Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix w…

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string replace against the decoded prefix. A request that encodes one or more characters of the configured prefi…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2024-58362] SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signi…

SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2024-58366] SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type …

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2024-58368] SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API r…

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2023-54366] SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREA…

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.

nvdaltovulnerabilidad CVSS 8.8 NVD