Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54597] ITFlow provides an IT documentation, ticketing and accounting system for small managed service provi…

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of the share_generate_link handler in agent/ajax.php. sanitizeInput applies string-context escaping, but…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54339] Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/…

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feed_url to discover_feed(feed_url), creates a subscription through FeedService.create_subscription(), and enqueues fetch_feed_task. The background path calls fetch_feed(feed.url) and parse_feed(), which assigns each RSS item link to ParsedEntry.url. The ta…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54354] MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS…

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml__type=Integer are configured, but it does not verify that attacker-controlled CGI qstring or OGC API Features featureId inpu…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-50275] The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. …

The Datadog PHP Tracer provides application performance monitoring and distributed tracing for PHP. Prior to 1.19.2, ddtrace_deserialize_baggage in ext/distributed_tracing_headers.c parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send an arbitrarily large number of comma-separated key-value pai…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-50277] dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses…

dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES on the extraction path, even though those limits are enforced during injection. A remote unauthenticated attacker can send a header containing many comma-separated key-value pairs or one very lar…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-15815] Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin arch…

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote cod…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-93337] NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with…

NetworkManager-l2tp contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inje…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92943] Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS…

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated ho…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54692] SAIL is a cross-platform library for loading and saving images with support for animation, metadata,…

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) pro…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54716] Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data…

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area geometry, rather than the other request options, triggers processing in src/loki/polygon_search.cc until t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-50125] MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes th…

MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-50285] Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/…

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in internal/authenticateflow/stateless.go. In hosted or stateless authentication deployments, an unauthenticated attacker can obtai…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-45720] Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.…

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-45726] Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1…

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceServi…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-90997] A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in r…

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to repla…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54239] Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticate…

Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in plugins/faustwp/includes/auth/functions.php. A logged-in non-administrator who obtains an authorization code from GET /generate can…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54253] TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/dow…

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a cra…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54504] MCP Documentation Server is a local-first document management and semantic search server for AI codi…

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with START_WEB_UI enabled by default and WEB_PORT set to 3080. startWebServer uses app.listen(PORT) without a host, which binds the unauthenticated document-management API…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52727] lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch…

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52851] Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user …

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Permission(LinkedHashMap) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in …

nvdaltovulnerabilidad CVSS 7.1 NVD