Alertas de Seguridad de la Información

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-109390] AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-ba…

AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. In the stream packet handler for mode 5 in the session protocol, a payload length value is not validated.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-103521] In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, …

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-103522] In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that rel…

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109228] SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers t…

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying servic…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109229] SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression …

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions to the generic image loader, exhausting worker memory during decoding.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-12613] Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Inform…

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-18390] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109205] LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in th…

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109225] SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthentica…

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109226] SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows…

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of servi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109227] SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in q…

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109199] LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authent…

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109201] LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocum…

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-108892] A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function…

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file /goform/ssid1MACFilter of the component Mac Filter. This manipulation of the argument newap_text_%d causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-108893] A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function s…

A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such manipulation of the argument vlan_set leads to stack-based buffer overflow. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-108894] A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStatic…

A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Netmask_setting/staticRoute_Gateway_setting/staticRoute_Metric_setting results in os command injection. Remote exploitation of the attack is po…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-93695] In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file…

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is wr…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109186] jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler tha…

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-52903] A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module …

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deseri…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109185] jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser h…

jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the tenant administrator roleId to escalate privileges or rebind other tenant users' roles.

nvdaltovulnerabilidad CVSS 8.8 NVD