Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 5 min

[CVE-2026-108160] AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allow…

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-107812] Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade …

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application in…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 2 horas

[CVE-2026-29797] No authentication is required when updating firmware or bootloader, making it easy for malicious fil…

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105295] GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates …

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid certificate once can intercept later automatic update checks, offer a fake version, and execute code as the user upon installation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

Vulnerabilidad alta en Reachy Mini: instalación de aplicaciones sin autenticación

El daemon de Reachy Mini expone una API HTTP sin mecanismos de autenticación en el endpoint POST /apps/install, permitiendo a atacantes instalar aplicaciones maliciosas remotamente en robots controlados por empresas de manufactura y automatización en LATAM. Con puntuación CVSS de 8.8, esta vulnerabilidad representa un riesgo alto para operaciones altas, cadenas de suministro y entornos industriales que dependen de estos dispositivos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-49450] Joplin is an open source note-taking and to-do application that organises notes and lists into noteb…

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-7006] Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contain…

Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a malicious DLL in the user-writable staging directory under %LOCALAPPDATA%, mark it read-only to bypa…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92128] Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by U…

Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context of the Jenkins controller JVM.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

Vulnerabilidad alta en Dell SCG 5.0: descarga de código sin validación de integridad

Dell SCG 5.0 (versiones Appliance anteriores a 5.36.00.16 y Application anteriores a 5.36.00.00) contiene una vulnerabilidad que permite la descarga de código sin verificación de integridad. Un atacante remoto no autenticado podría explotar esta falla para ejecutar comandos arbitrarios en sistemas afectados, comprometiendo la disponibilidad y confidencialidad de infraestructuras altas en entornos corporativos de LATAM.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85427] MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allow…

MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-82021] Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog…

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalo…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad alta en NVIDIA NemoClaw para Linux permite ejecución de código remoto

NVIDIA NemoClaw para Linux contiene una vulnerabilidad en sus scripts de instalación que permite descargar código sin validar su integridad. Un atacante puede explotar esto para ejecutar código arbitrario, escalar privilegios, acceder a información sensible o modificar datos. Afecta especialmente a centros de datos y empresas que utilizan herramientas de IA basadas en NVIDIA en infraestructura on-premise.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-65081] NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker co…

NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, information disclosure, and denial of service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/08/2026

Vulnerabilidad alta en NLTK 3.9.2 y anteriores permite inyección de código malicioso

NLTK (Natural Language Toolkit) anterior a versión 3.9.3 no valida la integridad de paquetes descargados antes de su extracción, permitiendo ataques de intermediario (MITM) o envenenamiento DNS para inyectar contenido malicioso. Afecta principalmente a empresas en LATAM que usan este framework en pipelines de procesamiento de lenguaje natural, análisis de datos y sistemas de chatbots.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-53970] ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby…

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-co…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-13433] IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified…

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.

nvdaltovulnerabilidad CVSS 8.3 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2021-47986] Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were p…

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2021-47987] Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags w…

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it defined a git-based dependency referencing one of the affected tags (for example, parse-server#4.9.3). The co…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55697] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/-

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55698] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap m…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager loc…

nvdaltovulnerabilidad CVSS 8.8 NVD