Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84842] IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the…

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-95274] Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attack…

Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-95276] Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacke…

Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84421] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84422] IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME re…

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84440] IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification …

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by the SNMP alerter service, which runs with root privileges.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102811] Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite…

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in handle_create_content and handle_clone_content to write files outside the project director…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102677] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102558] A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnectio…

A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102560] A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large…

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102697] Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experim…

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the ses…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102673] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click, did not receive the inherited HTML sandbox restrictions. An untrusted iframe using the allow-scripts allow-popup…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102674] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a sandboxed top-level document that was permitted to open popups could therefore create a window with the…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102676] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2022-51019] Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation an…

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-92370] An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modul…

An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuratio…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-92371] TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation v…

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-92368] TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer …

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature,…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-92369] TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in…

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84782] Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write tha…

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake …

nvdaltovulnerabilidad CVSS 8.2 NVD