Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

[CVE-2026-67623] Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to e…

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71294] Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that m…

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a `ci` POST parameter obtained via `cot_import('ci', 'P', 'TXT')` (trim-only sanitization) is passed to `unserialize(base64_decode($ci))` with no `allowed_classes` restriction, reachable by any member with write access to …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71284] Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_rest…

Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting: `cmd = "cp {} {}".format(source, backup_path); ret_code = os.system(cmd)`. The only pre-check on the filename is a prefix/suffix match (startswith(backup_prefix), endswith(v…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71285] Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-…

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo `siteId` value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: `_paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);`. The escaping pipeline used (jsesc with isScriptContext:true, then html-escaper.escape()) does not esc…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71287] Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names usin…

Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace('/[^a-zA-Z0-9_().]/', '', $column)`. Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as `SLEEP(5)` passes through completely unmodified. The sanitized value is…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71291] Bolt CMS renders content field values through Twig's full application-level Environment with no Sand…

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue() calls shouldBeRenderedAsTwig(), which gates rendering only on the field definition's allow_twig flag and a regex checking for `{{`, `{%`, or `{#`; when true, the raw field value is compiled and rendered via `se…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71276] Magistrala (formerly Mainflux)'s message-readers API reads a `format` value from the HTTP query stri…

Magistrala (formerly Mainflux)'s message-readers API reads a `format` value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf() in both the PostgreSQL reader (readers/postgres/messages.go: `fmt.Sprintf("SELECT * FROM %s WHERE %s ...", format, cond)`) and the TimescaleDB reader (readers/timescale/messages.…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71279] Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` paramet…

Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves `../` sequences, a name such as `../../tmp/evil.js` escapes the intended extensions directory. The extens…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71280] go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL us…

go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast() checks). An authenticated user creating or updating a bookmark via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext can s…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71271] Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP …

Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified() — unlike the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go, which does. Because Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1), an attacker registering a w…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71272] Memos' webhook dispatch function safeDialContext() (internal/webhook/webhook.go) resolves the target…

Memos' webhook dispatch function safeDialContext() (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost() and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address. Because net.Dialer.DialContext() performs its own independent DNS resolution, …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71261] dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk…

dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk(), a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly. The subseque…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71264] WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no setti…

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean `correctPIN` (wled0…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71265] Domoticz's MochadTCP::MatchLine() handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies …

Domoticz's MochadTCP::MatchLine() handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy() with no length check, across three separate code branches (DS10A/KR10A/MS10A device types). An attacker on the local network segment able to reach the Mochad TCP bridge (defaul…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71266] tinyobjloader-c's tinyobj_parse_and_index_mtl_file() (tinyobj_loader_c.h) reads each line of a .mtl …

tinyobjloader-c's tinyobj_parse_and_index_mtl_file() (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer `linebuf` via memcpy(linebuf, p, p_len), guarded only by `assert(p_len < 4095)`. Because assert() compiles to a no-op under -DNDEBUG (standard for release builds), a crafted .mtl file containing a line (e.g. a "newmtl" material name) longer than 4096…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71259] ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphom…

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl()`. Because `and` binds tighter than `or`, any file: URI passes validation regardless of netloc. This validator gates the `url:` field of the external_components YAML directive's git source s…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16022] @oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functiona…

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync(). A user-controlled project-name argument is inserted into the shell command without proper neutralization, allowing shell metacharacters to execute additional operating-system commands when the CLI…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Eclipse Theia 1.73.1 expone acceso no autorizado a archivos del servidor

Eclipse Theia versiones hasta 1.73.1 contienen una vulnerabilidad que permite a atacantes descargar archivos arbitrarios del servidor sin restricción de directorio workspace. El backend `@theia/filesystem` no valida correctamente las rutas URI en endpoints HTTP, afectando especialmente despliegues en navegador donde la validación de tokens es insuficiente. Empresas LATAM usando Theia como IDE en la nube corren riesgo de exposición de fuentes, configuraciones sensibles y datos de negocio.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en nanoMODBUS v1.23.0: desbordamiento de búfer en lectura de identificación

nanoMODBUS versiones anteriores a v1.24.0 contiene una escritura fuera de límites en la función recv_read_device_identification_res() (FC 0x2B/MEI 0x0E) que permite a servidores Modbus remotos sobrescribir memoria del cliente. Esta vulnerabilidad afecta sistemas de automatización industrial, SCADA y dispositivos IoT en plantas manufactureras, utilities y infraestructura alta en LATAM. Un atacante en la red puede ejecutar código arbitrario o causar denial of service explotando validaciones insuficientes del campo object_length.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-46581] In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not prope…

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

nvdaltovulnerabilidad CVSS 7.5 NVD