Alertas de Seguridad de la Información

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-6516] Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code …

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65700] h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that…

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65701] SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability …

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side path…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65702] Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persi…

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended store base directory. Attackers can supply path traversal sequences in the conversation_id parameter subm…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-47668] DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner …

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-47743] Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewir…

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to ta…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-47752] Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2…

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Versio…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-44909] Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A re…

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65917] CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDO…

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID th…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65916] CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in…

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16584] Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 migh…

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15612] Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling repl…

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-15614] Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within…

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-15615] Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audien…

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15616] Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass se…

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15617] Logto performs principal lookup without normalizing email and identifier strings, enabling principal…

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15611] Logto allows unverified email-based SSO account linking, enabling an attacker to register an identit…

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-43820] NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSS…

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-43823] When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-f…

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

23/07/2026

[CVE-2026-65898] DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an u…

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as s…

nvdaltovulnerabilidad CVSS 7.2 NVD