Alertas de Seguridad de la Información

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-41106] Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker …

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-50721] Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the …

Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to …

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-50722] Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verif…

Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a …

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-12413] An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Contin…

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-58460] react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-residen…

react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious application to write files outside the intended cache directory by supplying a crafted _display_name value containing dot-dot path components through a malicious ContentProvider. Attackers can fire an explicit ACTION_SEND intent at the consuming app's exported share-receiver activity to …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-38970] pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/mode…

pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

02/07/2026

[CVE-2026-38971] ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVL…

ardupilot through Plane-4.6.3 was found to contain an out-of-bounds read issue in libraries/GCS_MAVLink/GCS_serial_control.cpp in GCS_MAVLINK::handle_serial_control().

nvdcriticovulnerabilidad CVSS 9.1 NVD

R Alto vulnerabilidad

02/07/2026

[CVE-2026-38972] Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog …

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location and achieve arbitrary code execution in the context of the user …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-52189] Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to…

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_487330 component

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-52191] Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to…

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_444C8C component

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-52192] An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of se…

An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C component

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-52830] fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer…

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legac…

nvdcriticovulnerabilidad CVSS 9.4 NVD

N Crítico vulnerabilidad

02/07/2026

[CVE-2026-38968] ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacki…

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-59099] Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthen…

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect multiple client-side webflow execution tokens from the unauthenticated login page and perform known-plaintext analysis to decrypt the webflow …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-59092] JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that…

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection st…

nvdaltovulnerabilidad CVSS 7.7 NVD

W Alto vulnerabilidad

02/07/2026

[CVE-2026-59093] Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the…

Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) authorize only that the caller may assign roles to the target user or group, not the permissions contained in the assigned roles, unlike role c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-59094] Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob patte…

Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob pattern to indexed document paths using a hand-written recursive matcher that branches two ways on each ** token without memoization, giving exponential worst-case complexity. The filepath_globpattern value is taken from the body of the unauthenticated HTTP endpoints /v1/retrieve, /v1/inputs and /v2/answ…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-59095] LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows au…

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the project's ssrf-safe-fetch wrapper. Attackers can target…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-59096] Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-con…

Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-configuration document from the request Host, honoring an attacker-controlled X-Forwarded-Host header without validation when no allowed-hosts list is configured (the default), and serves the document with a one-hour public cache lifetime. A remote unauthenticated attacker can poison the discovery docu…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-58466] AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthe…

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full c…

nvdcriticovulnerabilidad CVSS 9.8 NVD