Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-26718] A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.…

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Alto vulnerabilidad

15/07/2026

[CVE-2026-59950] The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MC…

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in ve…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-62312] 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacke…

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to child_process.spawn(), allowing malicious custom plugins to execute commands through /api/mcp//sse. This issue is fixed in version …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-51380] Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a p…

Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-52887] NocoBase is an AI-powered no-code/low-code platform for building business applications and enterpris…

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authen…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-49352] 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback…

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-49353] 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-…

9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-46339] 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware d…

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

nvdcriticovulnerabilidad CVSS 10.0 NVD

L Alto vulnerabilidad

15/07/2026

[CVE-2026-52869] The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MC…

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the auth…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

15/07/2026

[CVE-2026-52870] The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MC…

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task, allowing any connected client to enumerate, read results fro…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-50144] ncnn is a high-performance neural network inference framework optimized for the mobile platform. In …

ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id …

nvdaltovulnerabilidad CVSS 7.1 NVD

C Crítico vulnerabilidad

15/07/2026

[CVE-2026-49445] Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, …

Cilium is a networking, observability, and security solution. Prior to 1.17.14, 1.18.8, and 1.19.2, when Cilium L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes, allowing a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy. This issue is fixed in versions 1.17.…

nvdcriticovulnerabilidad CVSS 9.2 NVD

A Alto vulnerabilidad

15/07/2026

[CVE-2026-45738] Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, a…

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation,…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-62349] TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.…

TDengine is an open source, time-series database optimized for Internet of Things devices. In 3.4.1.6 and earlier, source/libs/parser/src/parUtil.c trimString() checks space for only one byte before processing SQL string escape sequences \%, \_, or \x, allowing a one-byte out-of-bounds write to the stack buffer tmpTokenBuf that can cause denial of service and potentially remote code execution. Thi…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-62350] TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to …

TDengine is an open source, time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, a user with create udf privilege could upload a crafted shared library and install it as a user-defined function, such as eval, then execute arbitrary C code on the TDengine server side through database queries. This issue is fixed in version 3.4.1.15.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-46485] Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow …

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15895] OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allo…

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or later.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12997] The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a…

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4 via the 'gform_uploaded_files' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the targeted form to not enforce login (so publicly acce…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Crítico vulnerabilidad

15/07/2026

[CVE-2026-62948] OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DH…

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/sta…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59255] BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in…

BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpo…

nvdaltovulnerabilidad CVSS 7.1 NVD