Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76958] SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources i…

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86439] knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing atta…

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86541] knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() func…

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86437] Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with o…

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which exec…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86438] Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire a…

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86494] In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links…

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-79691] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-18453] A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling…

A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-19843] A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch comm…

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the e…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86435] commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnot…

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to create quadratic output expansion, consuming excessive memory and CPU to exhaust server resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86428] commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the Attrib…

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming disproportionate CPU resources and preventing legitimate requests from completing.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86430] league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced…

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent leg…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86433] commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attribu…

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection() performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks to cause parsing to take over 5 seconds, exhausting server resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86434] league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulne…

league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normalize(), which restarts its numeric-suffix search from 1 on every slug collision, resulting in O(K^2) time complexity for K headings that collapse to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOf…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80135] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86303] A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Aff…

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Thi…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86305] A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf4…

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86306] A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601…

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/Home/Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead to improper authentication. The attack may be performed from remote. The exploit has been made availab…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-79678] A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-…

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via me…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-6431] The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugi…

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts …

nvdaltovulnerabilidad CVSS 7.2 NVD