Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/09/2026

[CVE-2026-75034] A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for …

A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sess…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-75035] A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector nami…

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affec…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-71963] Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulner…

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh wh…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-55658] Gardens v2 is a modular governance framework that enables communities to create and manage multiple …

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 per…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-48486] Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (Po…

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The vulnerability was introduced when the SMART_FEES hardfork (block ~1…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85211] Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects …

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85212] CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServic…

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85213] Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints…

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85214] vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users …

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85179] Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch…

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85180] Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenti…

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85181] CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side ke…

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85182] vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to t…

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85183] Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowin…

Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85176] DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to…

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85178] Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKey…

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API key…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84989] ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, …

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-71404] A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name f…

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permission…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-75033] A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on …

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace und…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85110] A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of th…

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD