Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93277] In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Validate udata be…

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again, even though the driver resource has already been freed. Call ib_no_udata_io()…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75607] Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/…

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware authorization to the handler. Any authenticated viewer can send admin-only topics such as restart, notificati…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75608] Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/…

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal a…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-61628] nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/use…

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauth…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-61629] nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the …

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malform…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-82964] Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows …

Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM. When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89883] In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregiste…

In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rc_register_device() succeeds, later probe failures must undo the registration with rc_unregister_device(). The current error path jumps to the allocation cleanup label and only calls rc_free_device(), leaving the rc device registration and resources created by rc…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-57014] In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds wri…

In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-55149] Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior t…

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandl…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54632] SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPack…

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while UdpReceiver.EndReceiveFrom closes the channel when those operations raise a non-socket exception. A remote party can s…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-53752] docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including …

docx4j is an open source Java library for creating, editing, and saving OpenXML packages, including DOCX, PPTX, and XLSX files. Prior to 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-19136] A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, dist…

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-61517] Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the…

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command executed through system() with an incomplete denylist that only blocks spaces, pipes, semi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-78689] Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list p…

Description NGINX JavaScript (njs) has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n() method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list to that method. Both the njs and the QuickJS (qjs) engines are affected. A crafted prefix list cau…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-77180] When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exi…

When NGINX Ingress Controller is configured with Ingress annotations, an injection vulnerability exists in the configuration generator of NGINX Ingress Controller. Multiple user-controllable fields are written into the generated NGINX configuration without sanitization. An authenticated attacker with permission to create or modify these annotations may craft values that inject arbitrary NGINX conf…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-78222] A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() c…

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-66362] Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection …

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rende…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-18329] Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access …

Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition i…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-80208] APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in Interna…

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated cli…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-47852] A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malici…

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9

nvdaltovulnerabilidad CVSS 7.5 NVD