Alertas de Seguridad de la Información

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

Microsoft publica advisory de seguridad: CVE-2026-24301 Microsoft Copilot Information Disclosure Vulnerability. Tipo: Divulgación de Información.

Microsoft publica advisory de seguridad: CVE-2026-50419 Windows Kernel Information Disclosure Vulnerability. Tipo: Divulgación de Información.