Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71314] Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an …

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

Vulnerabilidad alta en Node.js HTTP/2 permite agotamiento de memoria remota

Un defecto en el manejo de HTTP/2 en Node.js permite que bloques de encabezados retenidos eludan el límite maxSessionMemory, facilitando ataques de denegación de servicio por exhaustión de memoria. Afecta Node.js versiones 24.x y 22.x, poniendo en riesgo aplicaciones web y APIs desplegadas en producción en data centers y servicios en la nube de LATAM.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69152] The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior…

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue i…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-53505] Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:pr…

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion() filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes (CPU/memory exhaustion) and cause denial of service. This issue is fixed in 7.8.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-53504] Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filt…

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, allowing a URL request to exhaust processing time. This issue is fixed in 7.8.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-18358] A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is …

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2024-25039] IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6…

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the web server to become unresponsive.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-9322] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67437] OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17…

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. T…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

29/07/2026

[CVE-2026-58182] The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instan…

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-65324] Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, le…

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-58151] Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and …

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14981] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-59932] PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 th…

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-59933] PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 th…

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can s…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54609] QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0…

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-66299] Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This iss…

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-42493] Addressing certain issues, in particular related to operations which may take excessively long and t…

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2025-63913] An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted r…

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-66142] Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or …

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD