Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47473] NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condit…

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-24229] NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, …

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or delete internal cluster state by sending requests to the FastAPI server. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-24233] NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model we…

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15643] AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that en…

AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all platforms might allow a remote authenticated user to exfiltrate AWS temporary security credentials to an a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15738] Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Con…

Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before 3.4.2 might allow an authenticated remote user to intercept, spoof, or deny another namespace's gRPC traffic on a shared Gateway via a crafted HTTPRoute resource. To mitigate this issue, users should upgrade to version 3.4.2.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-53633] Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vite…

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to use CDP Page.setDownloadBehavior and Runtime.evaluate to overwrite vite.config.ts and execute attacker…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-48068] @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. P…

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-48069] @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. P…

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in versions 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47479] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncont…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47480] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an unc…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47482] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missin…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective lifetime. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47736] Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY p…

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends bytes without CRLF to cause unbounded in-process memory growth and additional CPU cost from repeatedly…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47737] Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vuln…

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive request on the same connection, allowing an attacker to inject a second PROXY header and overwrite R…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-47428] Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Brow…

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in ve…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-47429] Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on…

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47476] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncont…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47477] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stac…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47478] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the us…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15709] A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. …

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A sep…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15711] A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to …

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles thi…

nvdaltovulnerabilidad CVSS 7.5 NVD