Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-77814] is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent direct…

is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, di…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-77815] to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collap…

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is_path_trusted in scripts/iib/api.py while pointing outside that directory, and FileResponse follows the link when serving the response, so a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-62867] Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-62940] Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an i…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the hos…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-62941] Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an ins…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check pas…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-63125] Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, pr…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlin…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-63343] Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image c…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The `exec-output` and `templates/` paths were patched in a prior release using `Lstat` rejection and `os.OpenRoot…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-55622] Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-48755] Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation…

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-48769] Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file w…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-55621] Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not au…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-48749] Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-48750] Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output`…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the `/instances/$name/exec` endpoint stores the output of the command in the `exec-output` directory of the instance. If `exec-output` is a symlink, file named `exec_UUID.stdout` and `exec_UUID.stderr` can be written to an arbitrary location where the `.stdout` file will contain arbitr…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-48751] Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots …

Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as `raw.lxc` and `raw.qemu`. Version 7.2.0 patches the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-48752] Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-48753] Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upl…

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-77806] SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited i…

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-77775] Proxy LLM de Headroom permite redirección no autorizada a servidores upstream

El proxy LLM de Headroom contiene una vulnerabilidad de redirección abierta que permite a clientes no autenticados especificar destinos upstream arbitrarios mediante el encabezado x-headroom-base-url. Un atacante puede redirigir solicitudes de LLM hacia servidores maliciosos bajo su control para interceptar datos sensibles, credenciales de API o prompts confidenciales. Afecta directamente a empresas en LATAM que implementan soluciones de proxy centralizado para modelos de lenguaje en arquitecturas de integración con proveedores cloud.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

Hace 2 días

Vulnerabilidad crítica en proxy LLM de Headroom permite suplantación de usuarios

Headroom's LLM proxy contiene una vulnerabilidad de autenticación insuficiente (CVSS 9.1) en el encabezado x-headroom-user-id que permite a atacantes acceder y modificar datos de memoria de otros usuarios sin autorización. El fallo afecta rutas de chat completion y websocket en headroom/proxy/handlers/openai.py. Empresas que usan este proxy para gestionar modelos de lenguaje corren riesgo de exposición de datos sensibles y suplantación de identidad.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 2 días

Vulnerabilidad alta en MCP Streamable HTTP: Agotamiento de memoria y Denegación de Servicio

El transporte HTTP del servidor MCP Streamable (variantes WebFlux y WebMvc) no limita la cantidad de sesiones que retiene y no requiere autenticación de clientes por defecto. Un atacante remoto puede acumular sesiones ilimitadas, agotando la memoria del servidor y causando Denegación de Servicio (DoS). Esta vulnerabilidad afecta infraestructuras altas en México y Latinoamérica que dependen de aplicaciones Spring Framework.

nvdaltovulnerabilidad CVSS 7.5 NVD