Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en lakeFS permite inyección de código mediante archivos Markdown

lakeFS, herramienta de código abierto que gestiona almacenamiento de objetos como repositorios Git, presenta una vulnerabilidad de XSS reflejado en su interfaz web que afecta versiones anteriores a 1.81.1 (edición open source) y 1.84.0 (edición enterprise). Un usuario con acceso de escritura puede inyectar HTML/JavaScript malicioso en archivos .md, comprometiendo la integridad de datos y sesiones de usuarios administrativos que visualicen el contenido afectado. El riesgo es alta en entornos LATAM donde lakeFS se utiliza en pipelines de datos y data lakes corporativos.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta de aislamiento en PraisonAI Platform API 0.1.3 y anteriores (CVE-2026-48169)

PraisonAI Platform API versiones anteriores a 0.1.4 presentan dos fallos de autorización que comprometen el aislamiento de workspaces. Usuarios autenticados pueden leer, modificar y eliminar recursos en cualquier workspace modificando UUIDs en solicitudes API, afectando altas equipos de IA multi-agente en organizaciones de LATAM que usan esta plataforma en producción.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en Home Assistant Companion permite ejecución de acciones por aplicaciones no autorizadas

Home Assistant Companion (versiones anteriores a 2026.5.3) no valida correctamente las aplicaciones que envían enlaces de etiquetas NFC o QR a través del sistema operativo, permitiendo que cualquier aplicación no confiable en el dispositivo ejecute acciones arbitrarias en la plataforma de automatización. Esto compromete la privacidad y seguridad local de hogares inteligentes en México y Latinoamérica que dependen de este software de código abierto.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

CVE-2026-66061: Validación insuficiente en Home Assistant iOS permite ejecución de acciones no autorizadas

Home Assistant versiones anteriores a 2026.5.0 presentan una vulnerabilidad alta en la aplicación iOS Companion que permite a aplicaciones no confiables ejecutar acciones mediante enlaces NFC o QR sin validación ni confirmación del usuario. Un atacante podría interceptar o redirigir estas acciones para comprometer dispositivos domóticos, sistemas de control industrial o infraestructura conectada en empresas LATAM. El riesgo es elevado en entornos con múltiples dispositivos IoT altas.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62295] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62296] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en gopacket permite denegación de servicio remota en aplicaciones Go

gopacket versión 1.7.0 y anteriores contiene múltiples decodificadores de capas que procesan longitudes, conteos u offsets controlados por el atacante sin validar contra los búferes de paquetes, permitiendo panic remoto. Aplicaciones que utilizan DecodingLayerParser o DecodeFromBytes en infraestructuras de análisis de tráfico, cortafuegos o sistemas de detección de intrusiones en LATAM son susceptibles a denegación de servicio remota.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-15972] Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthentic…

Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-48097] NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a use…

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on executable resolution through the `PATH` environment variable. An attacker controlling the execution environment can place malicious executables such as sudo ea…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-48098] NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a use…

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using `sudo` and `shell=True` directly inside application logic. In environments where passwordless sudo (`NOPASSWD`) is enabled, privileged commands may execute silently without explicit user confirmation. Version 2.0.0 fixe…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19231] A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vu…

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2025-71412] Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, o…

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-11430] Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. Wh…

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2025-63235] In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malfor…

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2025-71409] Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to in…

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-64636] An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authe…

An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19082] Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-…

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-71556] go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alp…

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-68772] ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component…

ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands wh…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-20345] A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attac…

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion operation, which may result in an out-of-bounds buffer write. An attacker could exploit this vulnerab…

nvdaltovulnerabilidad CVSS 7.5 NVD