Alertas de Seguridad de la Información

M Crítico vulnerabilidad

31/08/2026

ToolJet anterior a v3.16.208: Falla de validación de organizationId permite acceso no autorizado

ToolJet antes de la versión 3.16.208 no valida que el parámetro organizationId en las solicitudes de API coincida con el workspace autenticado del usuario. Un administrador de workspace puede crear, visualizar y eliminar tablas de base de datos en otros workspaces modificando el parámetro organizationId, comprometiendo la seguridad de datos en entornos multi-tenant críticos para empresas en LATAM.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

31/08/2026

ToolJet anterior a v3.16.208: vulnerabilidad crítica de escalamiento de privilegios entre organizaciones

ToolJet antes de la versión 3.16.208 no valida correctamente la pertenencia de usuarios autenticados a la organización especificada, permitiendo a usuarios Builder leer, modificar y eliminar tablas entre diferentes tenants. Los atacantes pueden extraer identificadores de organización de endpoints públicos y explotar operaciones de esquema para acceder a datos sensibles de otras empresas, representando riesgo crítico para empresas LATAM que utilizan esta plataforma en producción.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

31/08/2026

Vulnerabilidad de escalada de privilegios en ToolJet Database anterior a v3.16.44

ToolJet Database versiones anteriores a v3.16.44 contienen una vulnerabilidad de escalada de privilegios en el endpoint join_tables que otorga capacidades JOIN_TABLES a todos los usuarios autenticados sin validar rol o pertenencia al workspace. Atacantes pueden leer tablas arbitrarias de cualquier workspace en ToolJet Database suministrando identificadores de workspace víctima en la ruta de solicitud mientras se autentican con su propio workspace.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

31/08/2026

Vulnerabilidad crítica en ToolJet anterior a v3.16.208 permite acceso no autorizado entre organizaciones

ToolJet antes de la versión 3.16.208 presenta una falla crítica (CVSS 9.6) en la validación de propiedad de organizationId en rutas de escritura y eliminación de base de datos. Usuarios con rol de constructor pueden crear, modificar o eliminar tablas en bases de datos de otras organizaciones en instancias compartidas, comprometiendo la integridad de datos entre inquilinos. En entornos empresariales de LATAM con múltiples clientes en una sola instancia, esto representa riesgo de pérdida permanente de información y manipulación de esquemas.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

31/08/2026

Vulnerabilidad crítica en @hulumi/drift permite ejecución de planes maliciosos sin validación

Las versiones de @hulumi/drift anteriores a 1.3.2 aceptan planes de ejecución externos sin validar su procedencia, permitiendo que entrada de reconciliación no confiable sea tratada como confiable. Atacantes pueden inyectar planes maliciosos que eludan controles de seguridad para ejecutar operaciones de reconciliación no autorizadas, afectando sistemas de procesamiento de datos en empresas de México y LATAM con puntuación CVSS 9.8.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/08/2026

Vulnerabilidad crítica en hulumi v1.3.2 permite eludir restricciones IAM en despliegues

Versiones de hulumi anteriores a v1.3.2 contienen una plantilla SCP deficiente que permite a atacantes eludir las protecciones de límites IAM mediante bypass de etiquetas en la creación de recursos. Esta vulnerabilidad afecta directamente a organizaciones que implementan hulumi:iac-role para segregación de accesos en AWS, comprometiendo la integridad de los controles de identidad y acceso en infraestructura como código.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82860] @hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence…

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82861] @hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attac…

@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket configurations.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82862] Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing w…

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82668] A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerab…

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addr…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82854] Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.siz…

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82855] @hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudf…

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82856] @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition ope…

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82857] hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration…

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81624] Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how …

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82659] nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level…

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82630] A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager…

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82628] A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function …

A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a requirement.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-58574] Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenti…

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full adminis…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-40463] WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log File…

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser.

nvdaltovulnerabilidad CVSS 7.6 NVD