Alertas de Seguridad de la Información

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-55500] 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows f…

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55501] 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/…

9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value on each login attempt to receive a fresh rate-…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-54149] MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import function…

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing mode in apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file containing stdio transport with malicious commands and trigg…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-15143] A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allow…

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to server-side requests to arbitrary URLs or local file reads, potentially resulting in sensitive information disclosure, such as cloud provider credentials or…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61434] PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command executio…

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61437] PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vuln…

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandbo…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-61444] PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the a…

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-60091] PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the…

PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-56765] Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes s…

Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares. The GetTaskAttachment endpoint performs permission checks against user-supplied task IDs but fetches attachments by sequential ID without verifying ownership, allowing attackers to download and delete all fi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56279] Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RP…

Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56305] Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoin…

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate users and achieve full account takeover.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56254] In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distrib…

In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker performing a man-in-the-middle attack or compromising the Capgo server can create a validly signed update bundle and cause devices to install an update not produced by …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-29519] Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflect…

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that i…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-38057] The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication…

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate devi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-38059] The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An …

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version. The DID and TPK are used for satellite network authentication in the iDirect platform, …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-22659] FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that …

FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-22660] FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows auth…

FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a type mismatch in the bulk delete protection check. The bulk AJAX endpoint in the management views compares received JSON integer group IDs against string literals, causing the protection check to always pass, which …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-15378] A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacke…

A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery (SSRF) by submitting a specially crafted XML Schema Definition (XSD) string. This can lead to unauthorized access to sensitive information, including credentials from cloud metadata services, Kubernetes API, internal MinIO, and other internal network …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-40005] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-40006] Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, M…

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap pipe receiver accepts raw TCP connections on port 9780 with no authentication. The readLength method reads an attacker-controlled 32-bit integer from the socket and re…

nvdaltovulnerabilidad CVSS 7.5 NVD