Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/07/2026

[CVE-2026-57600] Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthe…

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

21/07/2026

[CVE-2026-56820] Netty is a network application framework for development of protocol servers and clients. In version…

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an…

nvdaltovulnerabilidad CVSS 7.4 NVD

G Alto vulnerabilidad

21/07/2026

[CVE-2026-16422] Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7…

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-65319] Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allow…

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and ext…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-61183] Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply …

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Reporting). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in …

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60768] Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Gr…

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Graph / Charting). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized creation, deletio…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

21/07/2026

[CVE-2026-56745] Netty is a network application framework for development of protocol servers and clients. In version…

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messag…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-52472] SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the…

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47416] PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior …

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint is gated by `require_workspace_member(workspace_id)`, which defaults to `min_role="member"` and is never overridden by the route. The handler then calls `MemberService.update_r…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16493] A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's conc…

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command e…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

20/07/2026

[CVE-2026-64624] FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line opt…

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-56624] Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java librar…

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-47198] Paymenter is a free and open-source webshop solution for management of hosting services. In versions…

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurati…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32806] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-16246] In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a r…

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\. Starting with BRAIN2 3.09, the setup no longer executes this tool. However, the optional component Bizerba ScriptService still executes it. Bizerba Sc…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-16247] In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup…

In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with _connect.BRAIN 5.06, the setup no longer …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-14448] An high privileged remote attacker can exploit an authenticated OS command injection vulnerability i…

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the system_certificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-16242] A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent…

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy,…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-42566] Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single nod…

Meshtastic is an open source mesh networking solution. Prior to version 2.7.23.b246bcd, a single node advertising a User.long_name that contains a malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The malformed name does not need to be maliciously crafted — it can arise from ordinary buffer truncation and has been observed occurring naturally …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64126] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add E…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of…

nvdaltovulnerabilidad CVSS 7.3 NVD