Alertas de Seguridad de la Información

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-84325] Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote a…

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-81928] Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data w…

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record. sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no terminati…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

01/09/2026

[CVE-2026-84479] WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely o…

WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

01/09/2026

[CVE-2026-84480] WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, al…

WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens to reset account passwords indefinitely. Attackers who obtain a recovery token can use it at any time to change the target account's password and gain full account access.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84482] WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_d…

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative ObjectYPT writes including live server configuration changes.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84208] AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Loca…

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents includi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84423] A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file …

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanat…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84476] WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers…

WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client address used by enforceRateLimit(). Attackers can rotate the header value per request to bypass login rate limiting and perform unlimited credential guessing attacks.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84478] WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allo…

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure abo…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84374] Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, i…

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $export->store(), or storeExcel() against the process working directory with realpath() instead of the configured filesystem disk. If the path names an ex…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84375] js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys…

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

01/09/2026

[CVE-2026-84372] Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 un…

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-83549] Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command I…

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

01/09/2026

[CVE-2026-75604] Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and…

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

01/09/2026

[CVE-2023-54391] Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in …

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with a…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84370] SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG …

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in plugins/removeScripts.js and lib/svgo/tools.js. The plugin does not recognize namespace-prefixed SVG anchor eleme…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84366] Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/co…

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta["is_secure"] is explicitly enabled, then signs and sends the plaintext request with configured AWS credentials. A n…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73782] A format string vulnerability exists in the command line interface of AOS-CX that could lead to unau…

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73773] An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Succe…

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73774] A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead …

A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticated disclosure of sensitive information by sending specially crafted packets to the affected system. Successful exploitation of this vulnerability could result in limited disclosure or modification of information and disruption of the affected system.

nvdaltovulnerabilidad CVSS 7.6 NVD