Alertas de Seguridad de la Información

M Alto vulnerabilidad

20/08/2026

[CVE-2026-72818] The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and app…

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-46355] BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebu…

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting b…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-17024] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-66787] A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. …

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with attacker-controlled IP addresses, causing other clusters' lighthouse DNS to redirect legitimate service traffic …

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-71428] The unstructured library provides open-source components for ingesting and pre-processing images and…

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-65842] Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote …

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the fetched image bytes in the generated DOCX, allowing server-side request forgery with response disclosu…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-61897] An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges …

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-11861] A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Dire…

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certifi…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76403] In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network …

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate valid…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76362] In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffi…

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76336] In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "powe…

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Representational State Transfer (REST) API. This could delete exported datasets and functions, affect system integrity, and cause partial service …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-53547] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains reset_code_ and temp_reset_token_ password-reset artifacts, allowing a low-privileged authenticate…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-18544] IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image polic…

IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-12633] The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6…

The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c processes the 6LoWPAN Context Option (6CO, RFC 6775) carried inside ICMPv6 Router Advertisements. In handle_ra_6co() the 8-bit context_len field is taken directly from the packet and was never bounded to the RFC maximum of 128. The function computes context->context_len / 8 and then performs memset(context->prefix + context_len, 0, sizeo…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-18821] IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW95…

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17042] IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.…

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition p…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17063] IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 i…

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions, resulting in an confidentiality, and…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17091] IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW95…

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash causin…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17097] IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW95…

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore n…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17414] IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW95…

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition performing a network boot can prevent that partition from completing its boot sequence. On partitions wher…

nvdaltovulnerabilidad CVSS 8.1 NVD