Alertas de Seguridad de la Información

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica en ArcadeDB anterior a 26.7.2 permite ejecución arbitraria de código JavaScript

ArcadeDB versiones anteriores a 26.7.2 no validan correctamente permisos de scripting en sentencias SQL DEFINE FUNCTION con lenguaje JavaScript, permitiendo que usuarios con acceso a la base de datos ejecuten código malicioso y eludir controles de seguridad. Este fallo afecta principalmente a empresas en LATAM que utilizan ArcadeDB para aplicaciones críticas sin actualizar regularmente. El CVSS 9.8 indica riesgo crítico que requiere atención inmediata.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta de validación en better-auth permite ataques de redirección OAuth

better-auth versiones anteriores a 1.6.13 y pre-lanzamientos 1.7.0-beta.0 a 1.7.0-beta.3 no validan correctamente el esquema de URIs de redirección en los plugins oidc-provider y mcp, permitiendo a atacantes registrar clientes OAuth con URIs maliciosas (javascript:). Esto expone a usuarios a ataques de suplantación de identidad y robo de tokens en plataformas que dependen de esta librería para autenticación federada.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en better-auth anterior a v1.6.11 permite aceptar tokens sin firma

better-auth versiones anteriores a 1.6.11 contiene defectos criptográficos en los plugins oidcProvider y mcp que permiten negociar el algoritmo 'none' y aceptan PKCE en texto plano en lugar de S256. Los atacantes pueden obtener tokens sin firma o interceptar códigos de autorización, comprometiendo sistemas de autenticación y autorización en infraestructuras cloud y on-premises que utilicen estas bibliotecas.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en GitPython anteriores a 3.1.51 permite inyección de comandos

GitPython antes de la versión 3.1.51 no valida opciones peligrosas de Git en los métodos Repo.archive(), git.ls_remote(), Repo.iter_commits() y Repo.blame(), permitiendo inyección de comandos y ejecución arbitraria a través de parámetros malformados como --exec, --upload-pack u opciones con prefijo guion. Afecta directamente a pipelines CI/CD, sistemas de control de versiones distribuido y herramientas de análisis de código en empresas LATAM que utilizan Python para automatización.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

01/08/2026

[CVE-2026-16144] The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote C…

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/08/2026

[CVE-2026-15450] The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file de…

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file() AJAX handler retrieving a file path from the database and passing it directly to unlink() with no validation (no realpath(), basename(), or allowlist check), combined with the insert_record() AJAX han…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/08/2026

[CVE-2026-15052] The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vul…

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesse…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-34641] Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code…

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-68771] ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node tha…

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt ref…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-17566] pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-s…

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/, gated only by the ordinary, commonly-granted tools_import_export_data permission) …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-17351] The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assist…

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQL's own parser: under standard_conforming_strings = on (PostgreSQL's defau…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-18446] fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI a…

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-10079] A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubern…

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name and labels and namespace "default". This bypas…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-12720] The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when i…

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via another installed Kirki WordPress plugin before 6.0.13, , or an outdated WordPress v…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-63221] CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch()…

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed i…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56672] ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file}…

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/{file} served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflows, and authenticated-equivalent API calls. The handler used web.FileResponse(path), so an uploaded .h…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56673] ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to…

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folder_paths.get_annotated_filepath and exists_annotated_filepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated crafted POST /prompt workflow using LoadImage or sibling nodes to probe arbitrary host paths and exfilt…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56671] ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2…

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, get_model_preview in app/model_manager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to use traversal, encoded traversal, absolute paths, or an unbounded path_index to read image-decodable f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-56670] ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2…

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripting in the ComfyUI origin. This issue is fixed in version 0.28.0.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-55502] Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/p…

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth token without Admin.Write to modify storage policy credentials. The route is inside the admin group that requires Admin.Read, but it does not …

nvdaltovulnerabilidad CVSS 7.1 NVD