Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-71303] Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_H…

Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the stored acme_url with an internal service or instance-metadata URL such as 169.254.169.254. The n…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-71307] Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/desti…

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allow…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-71308] Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit…

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-59915] Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violati…

Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-52829] ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can det…

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwa…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-47719] FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE…

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against ar…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-47629] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause impr…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-47628] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an a…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-24185] NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configura…

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access.…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-24183] NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivilege…

NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege management on the system. A successful exploit of this vulnerability might lead to escalation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-24184] NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon com…

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2025-9210] Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions b…

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-74038] Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote…

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-71551] Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabil…

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec(). The electron/preload.ts bridge exposes window.ea.exec() to renderer code, including community plugins exec…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-67262] Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped …

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-54552] sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplet…

sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs from an elevated process and launches a command with _uid set to an unprivileged user, the child changes its UID but can retain the parent process's supplementary groups because the privilege-drop sequence does not fully establish the tar…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-50143] The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, craw…

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor pu…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-48508] Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPer…

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-44472] Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account ac…

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use accountRegister to create an account with a victim's email address before the victim registers. If the victim fo…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-32657] Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRai…

Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version 10.3.0, Dell Unity Version 5.4, Dell PowerFlex Manager Version 4.5.4, Dell PowerFlex Intelligent Catalog Versions 46.377.00 and 46.382.00 and Dell PowerFlex Rack version 4.5.4 and prior versions, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerabil…

nvdaltovulnerabilidad CVSS 7.3 NVD