Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92792] OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied …

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the test_purpose key in evidence and providing enrolled measure and serial number pairs from the allowlist to gain unauthorized access.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92793] GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowi…

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92782] Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allo…

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92783] Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, a…

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of objects.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92784] @refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into gen…

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92785] Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registrat…

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92786] LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allo…

LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92773] Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installati…

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92776] Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, all…

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92779] Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability…

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92780] KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowi…

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without proper authorization.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92763] Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters…

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92772] Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endp…

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92752] metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that ca…

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92753] PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts…

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92761] WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only …

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92762] Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled f…

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92748] BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoin…

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicious files to sensitive locations for code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92749] SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math…

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92751] CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to per…

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes, leveraging the operator's HTTP Basic authentication credentials or play-basic-authentication cookie without S…

nvdaltovulnerabilidad CVSS 8.1 NVD