Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91200] DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod…

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91144] ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on…

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91145] Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, al…

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91143] goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allo…

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-12756] IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity …

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-12944] IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root…

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90819] A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function Ba…

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-86917] A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden …

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-84631] This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gat…

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-84568] A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Gol…

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-84553] A resource exhaustion issue was addressed with improved input validation. This issue is fixed in mac…

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-84505] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in mac…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-65414] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-65362] This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Se…

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-65364] An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Gold…

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause unexpected system termination.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-64701] A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia…

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-64712] This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Se…

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-53713] Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based…

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-s…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-53714] Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based…

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also au…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-43783] A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A mal…

A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD