Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/09/2026

[CVE-2023-54402] iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allow…

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling, including file:// URIs, to read arbitrary local files such as operating-system and application con…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-103471] restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing …

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-103474] yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, a…

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-103398] OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifes…

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-103270] LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without a…

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-96838] Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Frau…

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/09/2026

Vulnerabilidad de sincronización en funcionalidad de monitoreo permite denegación de servicio (CVE-2026-79625)

Múltiples productos presentan fallo en la sincronización de acceso a funcionalidad de monitoreo. Solicitudes concurrentes de clientes pueden causar lecturas/escrituras incorrectas o corrupción de estructuras de memoria internas. Un atacante autenticado con acceso de monitoreo puede explotar esto para procesamiento de datos incorrecto o denegación de servicio (CVSS 8.1).

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/09/2026

Agotamiento de memoria en clientes SFTP de Apache MINA SSHD (CVE-2026-94002)

Apache MINA SSHD versiones 0.9.0 a 2.19.0 y 3.0.0-M1 a 3.0.0-M5 contienen una vulnerabilidad de agotamiento de memoria en el componente sshd-sftp. El cliente SFTP (DefaultSftpClient) no valida que las respuestas recibidas correspondan a solicitudes legítimas, permitiendo consumo excesivo de recursos. Afecta a aplicaciones Java que utilizan esta biblioteca para transferencia de archivos segura.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-91832] The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings …

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-85573] The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload typ…

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102908] A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue a…

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-103088] Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, th…

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a Spring MVC application with a file: template prefix and a request-derived view name, a percent-encoded …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-103043] anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 hos…

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-76728] A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated re…

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102878] mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API t…

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-100292] In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through …

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if crafted inputs reach the underlying command handler.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102823] Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/s…

Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belon…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102810] Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by -…

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle_request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to the output folder, enabling attackers to request encoded traversal sequences to access files readable …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102634] SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_ro…

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84783] Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause i…

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS client, or a multi-threaded TLS server that requests client certificates, if the first certificate chains built to the same trusted CA certifi…

nvdaltovulnerabilidad CVSS 7.5 NVD