Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 3 horas

[CVE-2026-92705] Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loa…

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS`  file execute…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad Nuevo

Hace 15 horas

[CVE-2026-78019] Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusio…

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Filesystem access for attacker, and Remote execution.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105677] Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost…

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-12171] auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-change…

auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require(), so running auto-changelog over attacker-controlled repository content (for example, in a CI workflow that checks…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-105080] In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes the…

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-100256] In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible…

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-97150] When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.ph…

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-87114] A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrec…

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with r…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-54160] Network UPS Tools is a collection of programs which provide a common interface for monitoring and ad…

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was mis-structured in terms of mixing code running with higher privileges (single-use token generated with wr…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-95985] The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated ac…

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. We recommend you upgrade to Kiro IDE version 1.0.242 or later. U…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-17647] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-93993] Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation p…

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54916] NetBox Device Type Library is a collection of community-sourced device type definitions for import i…

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definition…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-54752] NetBox Device Type Library is a collection of community-sourced device type definitions for import i…

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function in tests/pickle_operations.py. An unauthenticated contributor can change USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and supply a c…

nvdcriticovulnerabilidad CVSS 9.6 NVD