Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56225] Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key managemen…

Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post). API keys created with mode=all but restricted to a single app via limited_to_apps are only checked for limited_to_orgs and not for limited_to_apps, so an app-scoped key can enumerate, update, and delete sibling API keys belonging to the same account that are outside…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56243] Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane…

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56248] Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerab…

Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger…

nvdaltovulnerabilidad CVSS 7.5 NVD

K Alto vulnerabilidad

23/06/2026

[CVE-2026-56258] Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpo…

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potent…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-10711] Missing authentication for critical function vulnerability in AKIN Software Computer Import Export I…

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CafePlus: from 12.05.03 before 12.05.04.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

23/06/2026

[CVE-2025-71337] Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vuln…

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account email address, used as a login identifier and password-recovery channel, via the account profile endpoint without confirming the change to the original email address or re-entering the current password. By changing the recovery email, an attack…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-71341] picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle f…

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-71365] picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.…

picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-71370] picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper func…

picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-71376] picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoCompl…

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.

nvdaltovulnerabilidad CVSS 8.1 NVD

T Alto vulnerabilidad

23/06/2026

[CVE-2023-54365] Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 req…

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-10521] An high privileged remote attacker can access a hidden configuration method, that should not be acce…

An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8172] The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input …

The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8379] The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce c…

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8163] The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some param…

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.

nvdaltovulnerabilidad CVSS 8.8 NVD

Z Alto vulnerabilidad

23/06/2026

[CVE-2026-10651] bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record b…

bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held the type-marker byte plus the 2-byte attribute ID (a check of buf->len < 3) but then read a fourth byte, the data-element descriptor (type), via net_buf_simple_pull_u8(). Because net_buf_simple_pull_u8() dereferences buf->data[0] before its only bounds guard (an __ASSERT_NO_MSG that compi…

nvdaltovulnerabilidad CVSS 7.1 NVD

Z Alto vulnerabilidad

23/06/2026

[CVE-2026-10658] bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timest…

bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbound HCI ISO Data buffer via net_buf_pull_mem() without first checking buf->len. The upstream hci_iso() handler enforces buf->len == the controller-declared ISO Data_Load length, so a malicious or buggy controller / adjacent BLE peer …

nvdaltovulnerabilidad CVSS 7.1 NVD

V Alto vulnerabilidad

22/06/2026

[CVE-2026-41523] vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert…

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.…

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

22/06/2026

[CVE-2026-53923] vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0…

vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation of tensor dimensions in vLLM's GGUF dequantize kernels (csrc/quantization/gguf/gguf_kernel.cu) causes partial tensor processing. The output tensor is allocated at full size via torch::empty (uninitialized memory), but the dequantize CUDA kernel processes only a truncated number …

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

22/06/2026

[CVE-2026-54232] vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM …

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM Dockerfile is vulnerable to a dependency confusion attack through the flashinfer-jit-cache package. The package is installed from a custom index (flashinfer.ai/whl/) using --extra-index-url, but the package name was not registered on PyPI, and UV_INDEX_STRATEGY="unsafe-best-match" is set globally. A…

nvdaltovulnerabilidad CVSS 8.8 NVD