Alertas de Seguridad de la Información

M Alto vulnerabilidad

20/07/2026

[CVE-2026-63771] Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate c…

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security con…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-62414] Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla ext…

Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-63107] LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the RES…

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud me…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-48389] DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability …

DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64612] A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng…

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitting a specially crafted PNG print job, leading to denial of service of the in-flight print job.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-48812] FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version …

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was creat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-39878] Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the …

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64191] In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block tra…

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the chip->words[256] register array, but does not validate it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the un…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64206] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendin…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for pending_rx_work. process_pending_rx() takes the same mutex, so teardown can deadlock against the worker it is flushing. This issue was found by our static analysis tool and then manually rev…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64188] In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpo…

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64189] In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race betw…

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-58484] Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentMa…

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the manifest's `path` field. `EnvironmentManager.pruneBackups()` later passes that trusted `entry.path` directly to `rmSync(entry.path, { recursive: true, force: true })`. An attacker who can place or modify a manifest inside `data…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-54051] Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandb…

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the agent sandbox gates shell commands behind an allowlist (`SandboxPolicy.isCommandAllowed`), which THREAT_MODEL.md calls the main control against a compromised agent (Adversary 3.2). The allowlist glob-matches the whole command string, but `ShellExecutor` runs that string through `/bin/sh -c`. So any wildcard al…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-46555] WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read a…

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these i…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-46701] Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE ser…

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.ts:254`) to return `true` unconditionally for every request — no `Authorization` header is required. Simultaneously, `_handleRequest` sets `A…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-39879] Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/…

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edit…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32824] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply `forwardToUrl` and `redirectUrl` values when triggering password reset or confirmation flows. Those values are then embed…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32825] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on t…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-35048] The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configurati…

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An u…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32806] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered…

nvdaltovulnerabilidad CVSS 7.5 NVD