Alertas de Seguridad de la Información

C Alto vulnerabilidad

10/07/2026

[CVE-2026-53450] Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects…

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 …

nvdaltovulnerabilidad CVSS 7.4 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-54329] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path m…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 8.5 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55460] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

C Alto vulnerabilidad

10/07/2026

[CVE-2026-53448] Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTT…

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated…

nvdaltovulnerabilidad CVSS 7.2 NVD

H Alto vulnerabilidad

10/07/2026

[CVE-2025-30007] HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-p…

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to premature…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56667] ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and S…

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reach…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56668] ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exch…

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55672] ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2…

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.

nvdaltovulnerabilidad CVSS 7.4 NVD

E Alto vulnerabilidad

10/07/2026

[CVE-2026-59161] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.1…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memo…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

10/07/2026

[CVE-2026-59162] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.1…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56675] 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted a…

9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v1 APIs such as /v1/models and may abuse configu…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55638] 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /…

9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider crede…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55641] 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy re…

9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication. In the default configuration, this exposes the /v1 proxy to upstream provider calls using stored provider credentials and allows /v1/sear…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55687] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.…

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt_tbl array without validating that it is in the range 0..3, allowing malformed …

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

10/07/2026

[CVE-2026-54063] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.1…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows = 1,048,576). A specially crafted XLSX file can trigger two d…

nvdaltovulnerabilidad CVSS 7.5 NVD

Y Alto vulnerabilidad

10/07/2026

[CVE-2026-54919] cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed T…

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT and a client connects to an IP-literal host with server certificate verification enabled, SSLClient and Clie…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-39244] adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated u…

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-39903] Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an author…

Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without ho…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-53657] Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on…

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addre…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-2398] Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilM…

Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 8.8 NVD