Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92125] Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTrans…

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox protection and executing arbitrary code in the context of the Jenkins controller JVM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92127] Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpat…

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

16/09/2026

Vulnerabilidad alta en Arista EOS permite ejecución remota de código con privilegios root

Arista EOS presenta una vulnerabilidad (CVSS 8.8) en la interfaz gRPC Network Management Interface (gNMI) que permite a clientes autenticados ejecutar código arbitrario con privilegios root en switches de red. Afecta infraestructuras altas de centros de datos y proveedores de servicios en LATAM que utilizan equipos Arista con gNMI habilitado. El riesgo es elevado en entornos de nube privada y redes corporativas donde estos switches gestionan tráfico sensible.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-16428] IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacke…

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/09/2026

[CVE-2026-90553] vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor l…

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81940] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-79742] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-78571] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81803] Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.

Subscriber Remote Code Execution (RCE) in RepairBuddy

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-19584] Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature…

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/09/2026

Vulnerabilidad alta en GitPython anterior a 3.1.60 permite ejecución de código arbitrario

GitPython versiones anteriores a 3.1.60 no valida correctamente la ubicación del directorio git, permitiendo que atacantes suplanten directorios git mediante archivos rastreados (gitdir, commondir, HEAD) e inyecten hooks maliciosos de pre-commit. Al ejecutar index.commit() en repositorios clonados o abiertos, se dispara código arbitrario en el contexto del usuario afectado, comprometiendo servidores de CI/CD, máquinas de desarrolladores y sistemas de control de versiones en empresas LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-85983] The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This …

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-78463] Improper control of generation of code ('code injection') in Remote Desktop Client allows an unautho…

Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-77908] Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an author…

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76191] Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability th…

Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69806] Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to …

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86732] Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index…

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86730] Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allow…

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-34223] A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC Click…

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected applicatio…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad alta en Bifrost HTTP transport permite ejecución de código remoto sin autenticación

Bifrost HTTP transport anterior a versión 2.0.0 permite a atacantes no autenticados cargar y ejecutar plugins maliciosos a través de POST /api/plugins cuando la autenticación de gestión está deshabilitada (configuración por defecto). El cargador de objetos compartidos descarga archivos desde URLs HTTP y los ejecuta como librerías dinámicas en Go, comprometiendo completamente servidores en infraestructuras altas de LATAM. Afecta especialmente a plataformas de integración y orquestación de datos sin hardening de seguridad.

nvdaltovulnerabilidad CVSS 8.1 NVD