Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/09/2026

[CVE-2026-61814] Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work wh…

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This iss…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96758] orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer …

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96759] orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanSta…

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96775] MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False securi…

MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96804] MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=…

MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96808] In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive reposito…

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other sessio…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96754] orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator tha…

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96755] orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect gen…

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96756] orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory gener…

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96757] orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Co…

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96656] Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be exec…

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96513] A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown p…

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96514] A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the…

A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-93349] Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console…

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-88830] A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication h…

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-88832] BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a hea…

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-85724] Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are config…

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write acce…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-6668] Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthentic…

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the proc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-19888] Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer th…

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2025-63564] SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to ex…

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests

nvdcriticovulnerabilidad CVSS 9.8 NVD