Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-55072] Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated…

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/D…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54155] node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIde…

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in packages/node-opcua-server/source/opcua_server.ts decrypts an RSA-OAEP password blob but does not verify that the trailing bytes match the current session serverNonce. An unauthenticated remote attacker can obtain the server public key through GetEndpoints and fo…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54156] node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-glo…

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by nonceAlreadyBeenUsed in packages/node-opcua-secure-channel/source/server/server_secure_channel_layer.ts records nonces from OpenSecureChannelRequest and CreateSession without expiration or a size limit. An unauthenticated remote attacker can repeatedly create ses…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90943] parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in com…

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90947] A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Eff…

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57132] PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled ma…

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their connected tools or private context to unauthenticated invocation. The vulnerability is fixed in 4.…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57119] PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an ab…

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data. …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57122] PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handle…

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPP_APP_SECRET or LINEAR_WEBHOOK_SECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the webhook route can forge messages, comments, or agent-session events, impersonate platform users, i…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-56839] PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_ro…

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-47701] The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.…

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor matched by serviceMonitorSel…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90789] A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue i…

A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument user_email can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82432] Description Nimbus validated `topology.blobstore.map` against the calling subject at submission tim…

Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could introduce a blobstore map entry naming a blob whose ACL does not grant them access. Supervisors localise …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82438] Description Three separate mechanisms allowed a web page on an unrelated origin to read responses t…

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's `Origin` header back in `Access-Control-Allow-Origin` while also sending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive `Access-Control-Allow-Origin: *` …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82427] Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each b…

Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper force-deletes whatever already exists at the target before creating the link. A s…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82428] Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key…

Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader caught `KeyAlreadyExistsException` and silently reused it, with no check that the existing blob's c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82429] Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker di…

Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the entry, and the trees being walked are owned and writable by the untr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82430] Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes …

Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without re-verifying its owner, so between the ownership change and the read…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57126] PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url …

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasse…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57129] PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_fi…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, k…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57130] PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/prais…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_e…

nvdaltovulnerabilidad CVSS 8.1 NVD