Alertas de Seguridad de la Información

L Alto vulnerabilidad

10/07/2026

[CVE-2026-55175] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2…

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 20…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-49213] TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/…

TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqUrl.ts can be bypassed with the IPv6 unspecified address :: because validateIPAddress blocks local, metadata, and private ranges but does not block :: or its expanded form. A workspace editor or creator can configure a server-side HTTP Request block or guarded script fetch to…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

10/07/2026

[CVE-2026-52747] ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS …

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 3.0.16, the multipart/form-data request body parser in libmodsecurity silently removes embedded line breaks from non-file form-field values before exporting them to ARGS and ARGS_POST because src/request_body_processor/multipart.cc overwrites reserved bytes in m_reserve instead o…

nvdaltovulnerabilidad CVSS 8.6 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-44795] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, …

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3,…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-58499] EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the…

EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint because the per-message sender_id field was not validated as a path-safe identifier, unlike app_id and project_id. During user-memory extraction, sender_id is used as owner_id and joined into the filesystem path where the extracted episode is persisted as …

nvdaltovulnerabilidad CVSS 8.2 NVD

B Alto vulnerabilidad

10/07/2026

[CVE-2026-57219] RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsol…

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauth_client_secret, exposing credentials to unauthenticated callers when the management plugin and that OAuth configuration are enabled. This issue is fixed in versions 3.13.15, 4.…

nvdaltovulnerabilidad CVSS 7.5 NVD

B Alto vulnerabilidad

10/07/2026

[CVE-2026-57220] RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not …

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6.

nvdaltovulnerabilidad CVSS 7.5 NVD

B Alto vulnerabilidad

10/07/2026

[CVE-2026-57212] RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbi…

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

nvdaltovulnerabilidad CVSS 7.7 NVD

B Alto vulnerabilidad

10/07/2026

[CVE-2026-57215] RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ …

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55213] h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11…

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55229] Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libre…

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in v…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

10/07/2026

[CVE-2026-55233] OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds wri…

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker p…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-41154] Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes thro…

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-45203] Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmwar…

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

10/07/2026

[CVE-2026-55827] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients la…

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-57850] RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, s…

RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope cont…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55789] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's …

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders u…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55377] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's …

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the log…

nvdaltovulnerabilidad CVSS 8.1 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55452] Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the…

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet so…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55466] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. T…

nvdaltovulnerabilidad CVSS 8.7 NVD