Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107377] datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.8…

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105840] lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted …

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-103591] DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability i…

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter. Attackers can supply a non-URL repo_url value to bypass path containment checks and read any file accessible to the API process by specifying absolute file paths.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100664] Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds t…

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93569] HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target…

HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89906] In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump o…

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmp_offset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under extra JIT passes. Fix this by calculating the offset directly on the absolute target: "ctx->offset[…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57119] PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an ab…

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data. …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-82092] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain se…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81554] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain se…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-64836] ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint du…

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check() validation function compares realpath() to boolean true, which never succeeds, allowing authenticated attackers to submit traversal sequences or absolute paths in the file parameter to read, write, or delete files outside t…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86099] Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowin…

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81192] `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for ho…

`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search path vulnerability on macOS. Prior to version 1.16.0-beta.2, the `host.id` resource attribute detector launches the `sh` and `ioreg` executables by bare name rather than by absolute path, so both are resolved through the `PATH` environment variable. A local att…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69612] Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileg…

Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-68896] Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to eleva…

Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86541] knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() func…

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19306] IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from …

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file content…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85606] firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_par…

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84201] appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and wri…

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended PROJECT_ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite arbitrary files with the server user's privileges, including shell profiles and configuration files i…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82217] In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change too…

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace w…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/08/2026

[CVE-2026-82635] Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto t…

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.plist) or an absolute path resolves outside ~/Downloads. The command then fetches attacker-controlled content from the supplied URL (via Rust HTTP, not the…

nvdaltovulnerabilidad CVSS 8.8 NVD