Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/09/2026

[CVE-2026-84841] Vulnerabilidad alta en tsi-dpdp-cms permite bypass de controles de seguridad

Se ha identificado una flaw de seguridad en tsi-dpdp-cms versiones hasta 0.5.0 que permite a atacantes remotos eludir mecanismos de validación del servidor mediante manipulación del lado cliente. El exploit está disponible públicamente, incrementando el riesgo de explotación inmediata en infraestructuras expuestas. Este vector afecta principalmente a sistemas CMS en pequeñas y medianas empresas de LATAM que no hayan aplicado parches.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/09/2026

Vulnerabilidad alta en HTTPX2: falla de inicio de TLS en conexiones WebSocket seguras por proxy SOCKS5

HTTPX2 (cliente HTTP de próxima generación para Python) versiones anteriores a 2.10.0 no inicia correctamente TLS al conectar a servidores WebSocket seguro (wss://) a través de proxy SOCKS5, debido a que el validador de protocolo solo reconoce https. La falla afecta aplicaciones que usan Client.websocket() y AsyncClient.websocket() desde v2.6.0, exponiendo comunicaciones que deberían estar cifradas en entornos corporativos y financieros de LATAM.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

Vulnerabilidad de desbordamiento de memoria en HTTPX2 anterior a versión 2.12.0 (CVE-2026-84382)

HTTPX2, cliente HTTP de nueva generación para Python, contiene una vulnerabilidad en sus decodificadores de contenido (gzip, deflate, br, zstd) que permite ataques de denegación de servicio. Fragmentos comprimidos de 64 KiB pueden expandirse hasta 64 MiB en memoria, causando consumo excesivo de recursos en servidores y aplicaciones Python. Afecta principalmente a infraestructuras que procesan contenido comprimido desde orígenes no confiables.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

Vulnerabilidad alta de RCE en DSpace 8.x, 9.x y 10.x afecta repositorios digitales

DSpace, software de código abierto ampliamente utilizado en universidades y instituciones públicas de LATAM para gestionar repositorios digitales, es vulnerable a ejecución remota de código (RCE) mediante plantillas Velocity en mensajes COAR Notify/LDN. Las versiones afectadas son 8.0-rc1 a 8.3, 9.0-rc1 a 9.2, y 10-rc1. Un atacante no autenticado podría ejecutar código arbitrario en el servidor con privilegios del proceso DSpace, comprometiendo la integridad de acervos académicos y datos sensibles.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

02/09/2026

Vulnerabilidad alta de contaminación de prototipos en TOON anterior a 2.3.1

TOON, librería de serialización compacta para prompts de LLM, contiene una falla de contaminación de prototipos (prototype pollution) en versiones anteriores a 2.3.1. Un atacante puede manipular datos TOON con claves __proto__, constructor o prototype para modificar Object.prototype en tiempo de ejecución, comprometiendo la integridad de aplicaciones que procesen datos no validados. El riesgo es alta en plataformas que integren LLM con entrada de usuario.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

02/09/2026

Vulnerabilidad alta de inyección de comandos en Nuclio anterior a v1.17.4

Nuclio, framework serverless para procesamiento de eventos en tiempo real, contiene una vulnerabilidad de inyección de comandos del shell en versiones anteriores a 1.17.4. Un atacante remoto puede ejecutar comandos arbitrarios en el host Docker explotando la interpolación no validada del namespace en comandos docker ps. El riesgo es alta en entornos con autenticación deshabilitada (configuración por defecto).

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-52831] Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4…

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger and stores it as the args of a Kubernetes CronJob container (/bin/sh, -c, ). Two fields in the trigger specification flow into this string without adequate sanitization: event.headers keys and event.body. This iss…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-52833] Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5…

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-53635] Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commi…

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with @login_required and performs no course-level permission check. Any authenticated user — including a learner account with zero course roles — can issue a single P…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-45730] Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0…

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target project) to bypass OPA authorization checks on write paths (PUT /api/projects/{id}, DELETE /api/projects) and modify or delete any project along with all its ass…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-20277] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20277 are related to protection mechanism failure issues that …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-20278] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are g…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-20280] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS …

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20280 are related to improper checking or handling of exc…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-20281] A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Vide…

A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when an affected device processes HTTP packets…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-20275] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20275 are related to incorrect calculation issues that are gro…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-20276] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20276 are related to insufficient control flow management issu…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-84837] A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing th…

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-84838] A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to e…

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-84675] OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able…

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable values to execute arbitrary commands on the agent running the build.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-84665] Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard lin…

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

nvdaltovulnerabilidad CVSS 8.0 NVD