Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54716] Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data…

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygon_search.cc until t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-50125] MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes th…

MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-50285] Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/…

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtai…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54239] Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticate…

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54253] TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/dow…

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a cra…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52727] lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch…

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52851] Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user …

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-19477] There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for …

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq).  This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux (uldaq) v1.2.1 and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92926] A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects t…

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54446] NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage …

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey query parameter pass through ApiKeyMiddleware in src/netlicensing_mcp/server.py without authentication. T…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-44236] rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP serve…

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value during amqp_login(), and rabbitmq-c accepts the value in amqp_login_inner() in librabbitmq/amqp_socket.c. amqp_tune_connection() in librabbitmq/amqp_connection.c uses frame_max to reallocate the outbound buffer without enforcing AMQP_FRAME_MIN…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-93292] SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel ana…

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92980] HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authen…

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely for data portability, to deploy and execute malicious code on the underlying application server host.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-28326] SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execu…

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-93014] RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Student…

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resources and other users' documents throughout the installation.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-89036] Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users w…

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permissions to execute arbitrary commands by injecting TAB characters into the providerRootDirectory parameter used to construct GNU tar commands. The application uses escapeshellcmd instead of escapeshellarg and fails to quote the parameter, allowing TAB character…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-86039] libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @lib…

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, a…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-85719] The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async…

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and NettyRequestSender attach Proxy-Authorization without confirming that the request is being sent to an HTT…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-85721] The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async…

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, automatic response decompression on the HTTP/1.1 path uses ChannelManager.newHttpContentDecompressor() to install Http1ContentDecompressor without a cumulative output-size limit. A hostile or compromised server, or an attacker who…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-85715] ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-cont…

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF ISO-BMFF files in getItems() within src/image-header-iso-bmff-iloc.js and trusts iloc itemCount and extentCount values while allocating an extent object for every nested-loop iteration. When offsetSize, lengthSize, baseOffsetSize, and indexSize are zero, the extent fields consume…

nvdaltovulnerabilidad CVSS 7.5 NVD