Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/09/2026

Vulnerabilidades altas en Heym anterior a 0.0.53 permiten ejecución arbitraria de código

Heym versiones anteriores a 0.0.53 contienen múltiples vulnerabilidades altas (CVSS 8.8). La más grave permite ejecución arbitraria de código Python mediante eval() sin sandbox en nodos de condición de flujos de trabajo. Cualquier usuario con permisos de edición de flujos o importación de plantillas maliciosas puede ejecutar código con privilegios del proceso backend. Afecta significativamente a empresas en LATAM que utilizan esta herramienta en automatización de procesos altas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/09/2026

Vulnerabilidad alta de ejecución remota de código en MONAI hasta versión 1.6.0

MONAI versiones 1.6.0 y anteriores contienen una vulnerabilidad de ejecución remota de código (RCE) en el motor de configuración de bundles que permite a atacantes ejecutar código arbitrario sin validación de lista permitida. Los agresores pueden distribuir bundles maliciosos con configuraciones manipuladas que se ejecutan cuando usuarios cargan bundles mediante monai.bundle.load(), afectando laboratorios de investigación médica y centros de datos en LATAM que implementan pipelines de procesamiento de imágenes médicas.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100570] OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace …

OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when gcloud is launched, and the gcloud launcher passes it as arguments to the trusted Python interpre…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-96795] Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/gene…

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes field_tuple[1], interpolates it into dynamic_fn_str as Python source, and passes the generated function definition to exec(). A crafted string that remains valid under ast.literal_eval can inject Python syntax into a defa…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-96749] An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled n…

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party wit…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-57178] Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `v…

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_i…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-90959] A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' pa…

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double sl…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-84691] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that f…

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that w…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-84706] A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type …

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits process-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH, PYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file inj…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-59991] psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.…

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95831] Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Pyth…

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly. The impact is that arbitrary code can be inv…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-53940] Conda is a system-level binary package and environment manager that runs on major operating systems …

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata. CreatePythonEntryPointAction in conda/core/path_actions.py interpolated that command into target_short_path, and Pr…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-55071] MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Pri…

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argumen…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-33625] LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 …

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted `quantization_config.quant_dtype` value. When a user loads the model with lmdeploy, the `…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54916] NetBox Device Type Library is a collection of community-sourced device type definitions for import i…

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An unauthenticated contributor can add a module such as tests/git.py that shadows GitPython when tests/definition…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92943] Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS…

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, via a certificate issued for an unrelated ho…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-85077] Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0…

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place attacker-controlled data in response.headers, file(..., filename=...), or cookie path and domain attributes can t…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-59974] Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of…

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating member paths, and the vulnerable extraction path is reachable through stanza.download and stanza.install_…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-88064] Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until…

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the docum…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-76825] RestrictedPython is a tool that helps define a subset of the Python language for accepting program i…

RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library string module, the string.Formatter class, a Formatter instance, or a Formatter subclass to restricted code. The string.Formatter methods for…

nvdaltovulnerabilidad CVSS 8.4 NVD