Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/06/2026

[CVE-2026-52800] Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management…

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be added to the Owners team. As a result, the attacker gains organization owner–equivalent privileges. This v…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-52801] Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functional…

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems from a lack of validation of SaveAddress function. This vulnerability is fixed in 0.14.3.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-47267] Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents …

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-33235] AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia…

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fill Text Template block is vulnerable to a Denial of Service (DoS) attack. While the backend implements a SandboxedEnvironment to prevent unauthorized attribute access (e.g., blocking __class__), it fails to limit the computational complexity …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-45687] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it directly into a MongoDB $set update via Object.assign. There is no allow-list of writable fields. An attack…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-45688] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's CAS login handler forwards the client-supplied options.cas.credentialToken value straight into a MongoDB findOne({_id: ...}) query without any runtime type check. TypeScript's string parameter annotation is erased at runtime, so an…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-45689] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant param…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-11998] A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies fo…

A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript sc…

nvdaltovulnerabilidad CVSS 7.6 NVD

K Alto vulnerabilidad

24/06/2026

[CVE-2026-13201] A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function us…

A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launch…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-1840] The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of …

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without restriction. Such unauthorized changes can disrupt normal functionality and, if performed repeatedly, m…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-55583] Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was…

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object reference (IDOR) in the AI agent monitor's AgentTurnResolver, in packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-monitor/reso lvers/agent-turn.resolver.ts. The agentTurns(agentId) query and the evaluateAgentTurn(turnId) mutation …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-47389] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17,…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.private_address? returns false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) corresponding to some private IPv4 addresses, depending on Ruby version, this can include loopback, RFC1918 private networks, and link-local space.…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-23879] py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encr…

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Versions 1.1.2 and below contain an an arbitrary file write vulnerability, which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using extractall to extract an archive, the library restores these symbolic…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-53950] @tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub clien…

@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-49247] Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog…

Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Client and Version fields and uses them unsanitized as components of the on-disk filename when persisting client-uploaded log documents. As a result, any authenticated non-admin user can include ../ sequences in the Client field to cause Jellyfin…

nvdaltovulnerabilidad CVSS 8.8 NVD

R Crítico vulnerabilidad

24/06/2026

[CVE-2026-49980] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute l…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-53943] Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared cach…

Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the…

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

24/06/2026

[CVE-2026-13038] Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote atta…

Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-48793] Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument …

Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion code path. SubtitleEncoder.ConvertTextSubtitleToSrtInternal (SubtitleEncoder.cs, line 382) interpolates the subtitle file path into FFmpeg command-line arguments without calling EncodingUtils.NormalizePath(). On Linux, filenames can contain d…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Crítico vulnerabilidad

24/06/2026

[CVE-2026-13028] Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacke…

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD