Alertas de Seguridad de la Información

M Crítico vulnerabilidad Nuevo

Hace 4 horas

[CVE-2026-108263] Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the…

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the docu…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107728] Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExt…

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inhere…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107782] System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc …

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107333] Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua …

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all res…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-71183] An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain infor…

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authe…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-66084] An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modif…

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. An authent…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-66087] An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to opera…

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the  * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint This issue affects Apache DolphinSchedul…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-107230] The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async…

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 3.0.14, connection-pool partitioning still omits identity-defining fields for Kerberos, SPNEGO, NTLM, and authenticated proxy connections. Logins without a configured principal, proxy realms, identities sharing a user name, and SOCKS or CONNECT prox…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-43976] wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management v…

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-106471] A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any o…

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this c…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106498] Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 a…

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under cer…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106492] Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @back…

Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. T…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-103007] Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated …

Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indic…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106371] Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.…

Incorrect authorization in Transactions Platform in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106372] Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to p…

Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106352] Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attac…

Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106350] Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker…

Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106329] Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attac…

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106309] Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a rem…

Incorrect authorization in Selection in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106314] Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attack…

Incorrect authorization in Bluetooth in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD