Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-65089] NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an …

NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-65090] NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacke…

NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-65081] NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker co…

NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, information disclosure, and denial of service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-65082] NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker …

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-74932] The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it…

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-68513] OpenEXR is the reference implementation and specification for the EXR image format, widely used in t…

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 contain a heap buffer overflow in PyOpenEXR triggered by a channel-name key collision between literal and prefixed RGB channels. When separate_channels=false, PyOpenEXR maps each physical channel name through channelN…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-68515] OpenEXR is the reference implementation and specification for the EXR image format, widely used in t…

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied, individually valid scanline EXR files whose union dataWindow is not aligned to one view's channel subsampling. …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-66152] A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an…

A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-66153] The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux…

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-59981] OpenEXR is the reference implementation and specification for the EXR image file format, widely used…

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, the OpenEXRUtil library returns an out-of-bounds pointer from the SampleCountChannel::row() API when a deep image has a non-zero dataWindow origin. The row() accessor is documented as 0-based…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55099] icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 u…

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 7.1.0 until 7.1.3, the Component equality method in src/icalendar/cal/component.py compares nested subcomponents with two membership loops, and each membership test invokes the same method on child components, causing O(2^n) work relative to nesting depth. Component.from_ical accepts arbitrarily nested BEG…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-45018] Chainlit is a Python framework for building production-ready conversational AI applications. From 2.…

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the endpoint accepts a user-controlled fullCommand string. The validate_mcp_command() function in backend/chai…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-45019] Chainlit is a Python framework for building production-ready conversational AI applications. From 2.…

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http transports, ConnectSseMCPRequest and ConnectStreamableHttpMCPRequest in backend/chainlit/types.py accep…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-43670] A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. T…

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79788] In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required …

In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI provider pointing to an arbitrary HTTP/HTTPS address (including internal/link-local hosts such as http://169…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-80049] Airbyte Platform resolves the workspace used for its authorization decision from a field the caller …

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults X-Airbyte-Workspace-Id ahead of every resource-derived header, including those for connection, source and destinati…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-78379] Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Ag…

Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards non_interactive_mode as a keyword argument through the batch tool. To remediate this issue, users should upgrade to version 0…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79786] Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically va…

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-79787] Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configurat…

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read, write, and delete arbitrary data.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55609] sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant s…

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export_state and import_state tools in src/consciousness-explorer/mcp/server.js pass the attacker-controlled filepath parameter to filesystem operations in src/consciousness-explorer/index.js without…

nvdaltovulnerabilidad CVSS 7.1 NVD