Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/09/2026

[CVE-2026-55658] Gardens v2 is a modular governance framework that enables communities to create and manage multiple …

Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 per…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-48486] Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (Po…

Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to receive an arbitrarily inflated block reward by crafting a block with a negative totalFeeCashBackNqt value. The vulnerability was introduced when the SMART_FEES hardfork (block ~1…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85211] Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects …

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85212] CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServic…

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85213] Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints…

Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read internal queues, flush server caches, and disable the server by putting the host out of rotation.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85214] vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users …

vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID in the request body. Attackers can overwrite other users' names, addresses, and disable accounts including administrators to cause denial of service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85179] Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch…

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85180] Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenti…

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal hosts including cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85182] vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to t…

vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change arbitrary account passwords by supplying a target account ID and that account's current password in the request body.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85176] DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to…

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85178] Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKey…

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API key…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84989] ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, …

ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-71404] A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name f…

A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name` annotation and overwrote that object's rules without verifying ownership. A user with delegated GlobalRole create or update permission could point the annotation at any existing ClusterRole, such as `cluster-admin`, and revoke the permission…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-75033] A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on …

A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifying that the referenced project belonged to the same downstream cluster. A user able to create namespaces on one cluster could set the annotation to a project ID from another cluster and have that project's secrets copied into a namespace und…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85110] A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of th…

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2025-12737] The administrative operations within the Carbon Console do not adequately validate specific user-sup…

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85174] SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file wh…

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85175] SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath…

SiYuan versions

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85164] WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set…

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85155] WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php …

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the f…

nvdaltovulnerabilidad CVSS 7.5 NVD