Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-75898] RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "In…

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, un…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32553] Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32473] Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versio…

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad SSRF alta en ArcadeDB anterior a v26.8.1 permite acceso a servicios internos

ArcadeDB versiones anteriores a 26.8.1 contienen una vulnerabilidad de falsificación de solicitudes del lado del servidor (SSRF) en el comando IMPORT DATABASE. Atacantes autenticados pueden eludir validadores de seguridad mediante redirección DNS o HTTP para acceder a endpoints de metadatos en la nube, servicios internos y bases de datos. Esta vulnerabilidad impacta directamente infraestructuras en AWS, Azure y Google Cloud ampliamente desplegadas en México y LATAM.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-74905] SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP …

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that em…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-64849] MLflow is an open source AI engineering platform for agents, large language models, and machine lear…

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated addr…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-56677] 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint i…

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC di…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73410] Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outbo…

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad alta de SSRF en Royal Elementor Addons para WordPress hasta v1.7.1064

El plugin Royal Elementor Addons es vulnerable a falsificación de solicitudes del lado del servidor (SSRF) en versiones hasta la 1.7.1064 a través del widget Form Builder. Un atacante puede inyectar URLs maliciosas en la configuración 'webhook_url' que se persisten en cada renderizado de la página, afectando sitios WordPress en la región que utilizan este componente popular para formularios. El riesgo es alta (CVSS 8.8) porque permite acceso a recursos internos y datos sensibles en redes corporativas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19753] A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the funct…

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this dis…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72855] Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import …

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73530] Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that all…

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address `::` which the kernel routes to loopback identically to `0.0.0.0`. Attackers can submit requests or trigger 302 redirects to ` to bypass the private IP range and blocked hostname checks in `is_private_ip()`, …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72777] Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api…

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses inc…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-49857] auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. …

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66704] Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-49478] Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC)…

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts.…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta de SSRF en Serendipity anterior a 2.6.0 permite bypass de filtros

Serendipity antes de la versión 2.6.0 contiene una vulnerabilidad de Server-Side Request Forgery (SSRF) que permite a usuarios autenticados con permisos de adminImagesAdd eludir validaciones mediante direcciones IPv4 hexadecimales, literales IPv6 y rangos link-local. Los atacantes pueden acceder a servicios internos y extraer cuerpos de respuesta a través del módulo de cargas públicas, exponiendo datos sensibles de infraestructura interna en empresas con Serendipity expuesto en Internet.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18952] Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics…

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-65941] In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network a…

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73264] Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provide…

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key …

nvdaltovulnerabilidad CVSS 7.6 NVD