Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 15 horas

[CVE-2026-108159] AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-…

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, execu…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 15 horas

[CVE-2026-108160] AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allow…

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-103043] anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 hos…

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js event loop and denying service to other requests.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-63460] Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API al…

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-b…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19205] Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Fo…

Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

Vulnerabilidad de discrepancia de respuesta en Menulux Portal permite suplantación de cuentas

Se ha identificado una vulnerabilidad de tipo Observable Response Discrepancy (CVE-2026-19080, CVSS 7.5) en Menulux Portal que permite a atacantes realizar footprinting de cuentas de usuario explotando diferencias detectables en las respuestas del servidor. Esta debilidad afecta versiones anteriores a 20260903211448 y representa un riesgo moderado-alto para restaurantes, cafeterías y establecimientos gastronómicos en LATAM que utilicen esta plataforma de gestión.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/08/2026

[CVE-2026-82475] iFlytek astron-agent: vulnerabilidad de omisión de autorización en copyFlow

iFlytek astron-agent versión 1.1.1 y anteriores contiene una vulnerabilidad de omisión de validación de autorización en el endpoint copyFlow que permite a atacantes autenticados enumerar identificadores de flujos de trabajo y sobrescribir workflows de otros inquilinos o copiar definiciones privadas. El impacto es alta para entornos multitenante en plataformas cloud corporativas de LATAM que utilizan esta solución para automatización de procesos.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80205] NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.fin…

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-77019] A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an …

A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.php. Executing a manipulation of the argument secode can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-77020] A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by thi…

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-67422] pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to …

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rend…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16765] A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unk…

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-45367] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7, the FHIRPathEngine implementation passes user-controlled regular expressions from matches(), matchesFull(), and replaceMatches() to Java regex operations without effective timeouts, allowing catastrophic backtracking and denial of service. This issue is fixed in version 6.9.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-49477] Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the …

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beau…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45756] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Fr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15134] A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by t…

A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59731] Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions…

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14640] A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unkno…

A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54299] Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 …

Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the f…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50146] Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts …

Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.

nvdaltovulnerabilidad CVSS 7.1 NVD