Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/08/2026

[CVE-2026-70455] rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to e…

rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-14456] Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packet…

Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-48702] Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.…

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73493] Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.2…

Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.23.18 and 1.0.0-M42, http4s-blaze-server aggregates fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denia…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-71469] A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests …

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-63299] An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level di…

An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-17271] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to impro…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad de negación de servicio en PLCnext Engineer (CVE-2025-41770)

Se ha identificado una vulnerabilidad de negación de servicio sin autenticación en la interfaz de comunicación PLCnext Engineer que permite a atacantes remotos interrumpir el acceso a través de la aplicación cliente. La explotación exitosa bloquea la comunicación hasta que el servicio PLCnext se reinicia manualmente, afectando operaciones altas en plantas industriales y sistemas de automatización en LATAM.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48804] python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-s…

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48802] python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to ver…

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. This issue primarily affects synchronous servers.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48809] python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions pri…

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73089] Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-…

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCache without a size cap, TTL, or eviction, allowing an attacker who can influence repeated browserslist() query values, including valid since `--` …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-54113] Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attack…

Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15561] A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and cou…

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72914] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14,…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18618] A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making…

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en Klever-Go permite denegación de servicio por agotamiento de recursos

Klever-Go (versiones 1.7.14 a 1.7.17) contiene una falla en el manejador de mensajes directos que crea goroutines sin límite antes de aplicar controles anti-inundación, permitiendo a atacantes remotos agotar memoria y CPU en nodos del protocolo blockchain Klever. Empresas que operan nodos de validación o infraestructura blockchain en LATAM pueden experimentar interrupciones de servicio altas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad DoS alta en Klever-Go 1.7.14-1.7.17 afecta nodos blockchain

Klever-Go, implementación en Go del protocolo blockchain Klever, presenta una vulnerabilidad de denegación de servicio (DoS) remota en versiones 1.7.14 a 1.7.17. Las APIs REST utilizan Gin Engine sin configurar timeouts de lectura ni límites de encabezados HTTP, permitiendo a atacantes remotos bloquear nodos. Empresas operando infraestructura blockchain o exchange en LATAM deben revisar si ejecutan versiones afectadas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-15972] Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthentic…

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-54225] Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apa…

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size li…

nvdaltovulnerabilidad CVSS 7.5 NVD