Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-61363] Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code …

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-59134] Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code …

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-21273] is affected by an Improper Input Validation vulnerability that could result in privilege escalation.…

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-21279] is affected by an Improper Input Validation vulnerability that could result in a Security feature by…

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-48056] Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions p…

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the  run-download  IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-71217] A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted cont…

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72867] Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomp…

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trig…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica en Kata Containers permite ejecución de código en el host

Kata Containers anterior a versión 4.0.0 es vulnerable a ejecución de código en el host mediante anotaciones de configuración sin validar. Un atacante puede especificar una ruta TOML arbitraria a través de la anotación io.katacontainers.config_path para cargar archivos maliciosos del host. Esta vulnerabilidad afecta infraestructuras containerizadas en datacenters y plataformas cloud de empresas LATAM que ejecuten orquestación con Kubernetes.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62295] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62296] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19177] Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a …

Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19169] Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.…

Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-57817] The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter …

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-20303] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst …

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are g…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-20273] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20273 are related to improper input validation issues that ar…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-16793] An improper neutralization of special elements used in an operating system command vulnerability was…

An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69185] Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.…

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/08/2026

[CVE-2025-71399] Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3,…

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extr…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en GitPython anterior a 3.1.50 permite inyección de código remoto

GitPython versiones anteriores a 3.1.50 no valida correctamente caracteres de salto de línea en el parámetro section de config_writer(), permitiendo a atacantes inyectar encabezados arbitrarios en .git/config. Los adversarios pueden manipular la sección [core] para dirigir hooksPath hacia directorios controlados, logrando ejecución de código remoto cuando se activan hooks de Git. Esta vulnerabilidad afecta principalmente a repositorios compartidos y entornos de integración continua en empresas de México y Latinoamérica.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica de bypass de autorización en @better-auth/scim (CVE-2026-67330)

El plugin @better-auth/scim para better-auth en versiones 1.4.0-beta.27 a 1.6.21 y 1.7.0-beta.0 a 1.7.0-beta.9 contiene una falla de autorización que permite a atacantes reutilizar identificadores de proveedores SSO/SAML/OIDC existentes en la emisión de tokens SCIM, comprometiendo la identidad de usuarios y cuentas corporativas. Afecta principalmente sistemas de gestión de identidades y acceso (IAM) en empresas que implementan provisionamiento automático de usuarios.

nvdcriticovulnerabilidad CVSS 9.9 NVD