Alertas de Seguridad de la Información

M Alto vulnerabilidad

20/07/2026

[CVE-2026-46555] WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read a…

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header validation, and the `/api/send` endpoint accepts an absolute `media_path` parameter without confining it to a safe directory. Combined, these i…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-46701] Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE ser…

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''` at `bin/mcp-server.ts:89`), which causes `_isAuthorized` (`lib/mcp-transport-sse.ts:254`) to return `true` unconditionally for every request — no `Authorization` header is required. Simultaneously, `_handleRequest` sets `A…

nvdaltovulnerabilidad CVSS 7.6 NVD

N Crítico vulnerabilidad

20/07/2026

[CVE-2026-41252] xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp,…

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with…

nvdcriticovulnerabilidad CVSS 9.8 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-41521] xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerabili…

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-39879] Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/…

Due to a missing sanitization call in [`afsql_dd_run_query`](https://github.com/syslog-ng/syslog-ng/blob/649e6e18e3459fb4467000a88dfb12fa97f9719c/modules/afsql/afsql.c#L219), syslog-ng before 4.12 are vulnerable to SQL injection from an untrusted source. This is not part of the default configuration, the SQL driver has to be manually configured. Fixes are in syslog-ng 4.12, syslog-ng Premium Edit…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32824] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply `forwardToUrl` and `redirectUrl` values when triggering password reset or confirmation flows. Those values are then embed…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32825] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the application accepts unlimited password guesses against both the browser login flow and the JSON login endpoint. The source code enables Devise's `:lockable` module on t…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-35048] The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configurati…

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An u…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32806] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32820] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, the documentation and static markdown renderer accepts attacker-controlled path segments and only runs them through the Rails HTML sanitizer, which does not remove director…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32821] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the collection API to evaluate permissions as a different user by supplying `user_email`. If the target us…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-63429] HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authe…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no session cookie check. Any anonymous internet user can upload files (PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP4, images, etc., up to 10 MB) and receive a permanent public URL on the HeyForm domain. The endpoi…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-51027] An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2…

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-46412] @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with Op…

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of `@beproduct/nestjs-auth` (0.1.2 through 0.1.19). The postinstall payload attempted to harvest npm tokens (from `~/.npmrc`); GitHub personal access t…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-46415] The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate request…

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy. In deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the …

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-45713] Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP s…

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value (0 ⇒ "no limit"). The same applies to the HTTP /api/v1/send endpoint, whose request body is decoded with json.NewDecoder…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-35198] HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.

nvdcriticovulnerabilidad CVSS 9.0 NVD

H Alto vulnerabilidad

20/07/2026

[CVE-2026-26197] HDF5 is a high-performance library and a file format specification that implements the HDF5 data mod…

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.…

nvdaltovulnerabilidad CVSS 7.5 NVD

W Alto vulnerabilidad

20/07/2026

[CVE-2026-28220] Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior …

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API (DAPI) handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the master node deserialize an attacker-controlled callable and execute it under an attacker-controlled RBAC c…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32807] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied…

nvdaltovulnerabilidad CVSS 7.5 NVD