Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-107823] MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1…

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106102] Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.…

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. A…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-95274] Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attack…

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

18/09/2026

Vulnerabilidad crítica en Synology DiskStation Manager permite lectura/escritura de archivos arbitrarios

Una falla en la codificación de salida del componente SCGI en Synology DSM afecta versiones anteriores a 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 y 7.4-90075, permitiendo a atacantes remotos leer, modificar archivos arbitrarios y ejecutar ataques de negación de servicio. Empresas en LATAM que usan NAS Synology para almacenamiento centralizado están en riesgo inmediato de exposición de datos sensibles e interrupciones operativas.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54506] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forb…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54182] backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of …

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from BackpackServiceProvider::boot() and constructs a shell command with a URL influenced by the HTTP Host header, which i…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-73195] Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can …

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes. When such users are included in a CSV export and the generated CSV file is opened by a spreadsheet application, the formula may be executed. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 T…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

09/09/2026

[CVE-2026-54694] SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code fl…

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. `StringHighlighter.js` builds an HTML string by interpolating raw `value` substrings directly into a template literal with no HTML entity encoding. `HighlightedValue.vue` renders that str…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69821] Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an a…

Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

02/09/2026

CVE-2026-84292: Validación insuficiente de puerto en fast-uri permite inyección de autoridad

fast-uri no valida el componente de puerto al recomponer la autoridad de una URI, permitiendo que valores no numéricos inyecten delimitadores y redirijan la conexión a hosts controlados por atacantes. Esta vulnerabilidad afecta aplicaciones Node.js en producción que procesen URLs de fuentes no confiables, comprometiendo autenticación y enrutamiento en infraestructuras cloud de LATAM.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81522] A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows spec…

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-61824] Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt a…

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts,…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2025-36254] IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 …

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2025-51677] An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the…

An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the netlist of the or1200 cpu output port can lead to unexpected behavior.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-15809] A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allow…

A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48358] Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could re…

Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-62184] luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IP…

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55659] Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-…

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when openin…

nvdaltovulnerabilidad CVSS 7.7 NVD

E Alto vulnerabilidad

01/07/2026

[CVE-2026-49091] Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Inject…

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-55570] SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape th…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted and the value is produced with JSON.stringify() (which does not escape ', ), a package whose name contains a singl…

nvdcriticovulnerabilidad CVSS 9.0 NVD