Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108806] A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36…

A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-87690] The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relativ…

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108799] A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacte…

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicl…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108798] A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unkno…

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108985] ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs…

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108980] Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugi…

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Do…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-66086] In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation o…

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-108783] A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affe…

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108976] GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because t…

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108963] databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., maria…

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-19935] The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred proc…

The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM (0x0080-0x00FF). Channel teardown in l2cap_chan_destroy() in subsys/bluetooth/host/l2cap.c cancels the retransmission-timeout work and drains the RX FI…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-19577] net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with…

net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(nbr->idx) without first checking whether the neighbor cache entry actually had a linked link-layer address. An unresolved neighbor carries idx == NET_NBR_LLADDR_UNKNOWN (0xff), and net_nbr_get_lladdr() in subsys/net/ip/nbr.c performs no runtime bounds check beyond a NET_ASSERT, r…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-19669] The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in d…

The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_props[len], sized directly by the caller-supplied len argument. len is an unvalidated size_t taken straight from the syscall ABI, and the VLAs were alloc…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-19736] The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte cou…

The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts the SDK compiles its TRNG_SW_HEALTH_TESTS variant, which always copies whole 32-bit words and draws entropy rounded up to a multiple of 128 bytes. Its "caller buffer is full" guard tests dataSize == 0, so a req…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108913] omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because th…

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108902] pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the pict…

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108905] pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool…

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108863] Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenti…

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump endpoint to read configured LLM provider API keys in plaintext from the WASM filter configuration.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108865] AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthentica…

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/10/2026

[CVE-2026-108859] mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP th…

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.

nvdaltovulnerabilidad CVSS 7.5 NVD