Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/09/2026

[CVE-2026-79644] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-18355] A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). I…

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet().…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80164] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-76560] A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an …

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a dir…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80130] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80131] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-14444] The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to…

The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, and who possess the access_key, to create a new u…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86435] commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnot…

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86428] commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the Attrib…

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86429] The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains qu…

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can su…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86430] league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced…

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent leg…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86431] league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scrip…

league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86433] commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attribu…

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86434] league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulne…

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOf…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86427] LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter tha…

LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inject arbitrary rrdtool arguments by breaking out of double-quote escaping. Attackers can inject DEF and LINE arguments to read RRD files from unauthorized devices, or use newline injection to execute arbitrary rrdtool commands, bypassing per-device authorization…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80135] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86303] A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Aff…

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Thi…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86305] A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf4…

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86306] A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601…

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead to improper authentication. The attack may be performed from remote. The exploit has been made availab…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-79678] A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-…

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via me…

nvdaltovulnerabilidad CVSS 8.1 NVD