Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/08/2026

[CVE-2026-59893] sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/key…

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74874] openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographi…

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73568] py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yam…

py-libp2p is the Python implementation of the libp2p networking stack. In 0.7.0 and earlier, the yamux handle_incoming() method in libp2p/stream_muxer/yamux/yamux.py reads an attacker-controlled 32-bit DATA frame length with read_exactly() before validating it against MAX_WINDOW_SIZE or checking whether stream_id exists. A peer that completes the standard Noise handshake can send a 12-byte frame d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en GitPython antes de 3.1.57 permite ejecución de comandos arbitrarios

GitPython versiones anteriores a 3.1.57 no valida correctamente los parámetros pasados a IndexFile.checkout() y TagReference.create(), permitiendo a atacantes inyectar opciones peligrosas de git como --prefix para sobrescribir archivos arbitrarios o -F para exfiltrar datos. Esta vulnerabilidad afecta principalmente a plataformas de CI/CD, sistemas de versionado y herramientas de automatización ampliamente utilizadas en empresas mexicanas y latinoamericanas.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en GitPython permite exfiltración de secretos a través de expansión de variables

GitPython versiones anteriores a 3.1.55 no desactiva correctamente la expansión de variables de entorno en los métodos Remote.create() y Submodule.add(), permitiendo a atacantes inyectar referencias de variables en URLs que se expanden en .git/config y .gitmodules. Durante operaciones de fetch o pull, estas variables se transmiten a servidores controlados por atacantes, comprometiendo tokens de acceso, credenciales de APIs y secretos almacenados en variables de entorno. Afecta desarrolladores y sistemas CI/CD que procesan repositorios no confiables.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en GitPython permite ejecución de comandos arbitrarios en operaciones de clonación

GitPython versiones anteriores a 3.1.54 contiene una denylist incompleta que omite la opción --template, permitiendo a atacantes ejecutar comandos arbitrarios mediante hooks maliciosos durante operaciones de clonación. Esta vulnerabilidad afecta directamente a sistemas CI/CD, pipelines de desarrollo y servidores que utilizan GitPython para automatizar gestión de repositorios, siendo alta en entornos DevOps de empresas en LATAM que dependen de flujos de integración continua.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en GitPython: sobrescritura arbitraria de archivos en versiones anteriores a 3.1.54

GitPython anterior a la versión 3.1.54 contiene una vulnerabilidad que permite a atacantes sobrescribir archivos arbitrarios mediante el método Diffable.diff, explotando la falta de validación de opciones git. Un atacante puede ejecutar esta acción con los permisos del proceso, afectando sistemas de control de versiones en empresas que usen esta librería en pipelines de CI/CD, especialmente en entornos cloud y DevOps de México y Latinoamérica.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta de ejecución remota de código en GitPython anteriores a 3.1.54

GitPython versiones anteriores a 3.1.54 contiene una vulnerabilidad de ejecución remota de código (RCE) que permite a atacantes eludir validaciones de seguridad mediante opciones git manipuladas. Los métodos clone_from, fetch, pull, push, ls_remote, iter_commits, blame y archive pueden ser explotados para ejecutar comandos arbitrarios del sistema operativo. Empresas en LATAM que usen GitPython en pipelines CI/CD, sistemas de gestión de repositorios o herramientas de DevOps están en riesgo alta de comprometer servidores y datos sensibles.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73325] Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability tha…

Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce_…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta en Snowflake Python API permite escalada de privilegios (CVE-2026-19594)

La API de Python de Snowflake (snowflake.core) en versiones anteriores a 1.13.0 presenta sanitización insuficiente de entrada, permitiendo ataques de escalada de privilegios tipo confused-deputy mediante traversal de rutas y contaminación de parámetros HTTP. Afecta directamente a plataformas de datos en la nube usadas por empresas financieras, retail y telecomunicaciones en LATAM que integran Snowflake con aplicaciones downstream. CVSS 8.1 (Alto).

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48804] python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-s…

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48802] python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to ver…

python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection is received, and when the client sends a PONG packet. This issue primarily affects synchronous servers.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48809] python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions pri…

python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-54981] Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension al…

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-67422] pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to …

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rend…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-9196] IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended co…

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-8470] IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through…

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authe…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-17632] IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71284] Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_rest…

Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting: `cmd = "cp {} {}".format(source, backup_path); ret_code = os.system(cmd)`. The only pre-check on the filename is a prefix/suffix match (startswith(backup_prefix), endswith(v…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-67195] Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attacke…

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpr…

nvdaltovulnerabilidad CVSS 8.8 NVD