Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77605] Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run …

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd appended, and the user invokes Run by system on the text file on Windows 10 or Windows 11, Notepad++ can…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77258] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, upload_attachment in src/mcp_atlassian/confluence/attachments.py accepts a caller-controlled file_path and opens the selected server-local file without restricting it to the workspace. A permitted Confluence MCP caller can upload the file as an attachment and disclose data readable…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77261] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _make_ssrf_safe_hook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauth_pat branches. If an attacker-controlled or compromised configured Atlassian instance returns a redirect to an internal address, those sessions can follow the red…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77243] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ENABLED_TOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that knows a hidden tool name can directly invoke excluded read, write, or delete tools despite the operator's configured least-privilege restriction…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77242] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller can use a short-lived DNS answer that is public during validation and private during connection, preserving unauthenticated access to internal…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-43642] Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerabili…

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the from_billing_module parameter present. Attackers can pass malicious serialized data through the billing_data POS…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-43643] Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerabil…

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94455] An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable withou…

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instanc…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-87902] An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen…

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-85740] LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_address…

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.is_global without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A caller who can upload a Markdown or textpack document can supply an external image URL using NAT64 64:ff…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83603] Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command…

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83598] Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Ag…

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulner…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83599] Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket s…

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow decompressed output toward WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio. Small highly compressed frames can t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-13087] A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply …

A heap out-of-bounds write vulnerability was found in the Linux kernel's RPC-over-RDMA server reply path in net/sunrpc/xprtrdma/svc_rdma_sendto.c. When a crafted RPC-over-RDMA client sends a large NFS READ request with an empty Write list and no Reply chunk, the server linearizes the entire multi-page reply into a fixed-size 4096-byte heap buffer without bounds checking, resulting in a kernel heap…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94640] A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a…

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95653] Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creatio…

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95654] Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching …

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95655] Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowi…

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-80148] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-80149] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web…

nvdaltovulnerabilidad CVSS 8.6 NVD