Alertas de Seguridad de la Información

V Alto vulnerabilidad

09/07/2026

[CVE-2026-59856] Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script i…

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honor…

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

09/07/2026

[CVE-2026-59858] Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in …

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59832] SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepa…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document d…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59834] SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endp…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This iss…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

09/07/2026

[CVE-2026-33655] New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys…

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve a hostname and validate the resolved IP address, allowing authenticate…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-58122] Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthentic…

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overw…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-58123] Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that al…

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-58143] Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows una…

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension white…

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

09/07/2026

[CVE-2026-57028] An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Netw…

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion. Due to an incorrect initialization, a process which should only be able to communicate internally within the device, can be reached over the network via an open port. This leads to unauthorized acc…

nvdaltovulnerabilidad CVSS 7.3 NVD

J Alto vulnerabilidad

09/07/2026

[CVE-2026-57023] An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Junip…

An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS). When TCP proxy is engaged in a flow session, to support ALGs, Advanced Anti-Malware, ICAP or UTM, a TCP packet with specifically malformed TCP h…

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

09/07/2026

[CVE-2026-57026] An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper …

An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).If the SIP ALG is enabled on an affected device, the processing of a malformed SIP invite packet will cause a flow processing daemon (flowd) crash and restart.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-55604] DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version…

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retr…

nvdaltovulnerabilidad CVSS 8.6 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-49256] Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5…

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-53963] Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5…

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

nvdaltovulnerabilidad CVSS 7.3 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-39246] decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing…

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink …

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-44787] Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5…

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

nvdaltovulnerabilidad CVSS 8.2 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-45788] Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5…

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an attacker knew the secured upload URL and the secure_uploads site setting was enabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-38076] An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attac…

An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15271] A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS…

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-55208] Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1…

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and other listing endpoints accept a columnFilters array where the key field …

nvdaltovulnerabilidad CVSS 7.7 NVD