Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/10/2026

[CVE-2026-82334] IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in th…

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-82335] IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the M…

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107707] Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimiza…

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-95209] An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of …

An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-84276] IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-con…

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-84278] IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root …

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-40804] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107701] dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modif…

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107385] MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL …

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlle…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107383] MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL …

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop sk…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107384] MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL …

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cau…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-106433] Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as…

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the applic…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107322] An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin befo…

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context. To remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later a…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-95184] Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certif…

Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107376] webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\…

webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, befo…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107377] datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.8…

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107362] Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) lar…

Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched respo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107375] JHipster is a development platform to quickly generate, develop, and deploy modern web applications …

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/da…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107337] The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authenti…

The Malcolm kiosk Flask application exposes a POST /script_call/ endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/10/2026

[CVE-2026-107302] msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder rea…

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or wor…

nvdaltovulnerabilidad CVSS 7.5 NVD