Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 8 horas

[CVE-2026-103413] Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, K…

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-107720] fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier …

fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is false, and the empty signature avoids the verifySignature gate. An attacker can therefore submit a token …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-76468] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networkin…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76468 are related to improper input validation that are grouped un…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-76456] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS eng…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76456 are related to improper input validation of special elements used…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106443] WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in we…

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsImagePlugin invokes the interpreter for attacker-co…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106414] Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remo…

Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-55269] In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper …

In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-101919] A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configurat…

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When dow…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-85532] Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. T…

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102823] Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/s…

Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CHANNEL_REQUEST subtypes exit-status, exit-signal, and xon-xoff to public client::Handler callbacks without confirming that the ChannelId belon…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-95381] Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attac…

Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-95341] Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attack…

Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-95276] Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacke…

Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102677] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was served for. A compromised renderer could write attacker-controlled cache data and cause Electron to reuse it for a later load, executing the…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102600] Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @s…

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Nod…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-12342] This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code…

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad alta de inyección de comandos PowerShell en ManageEngine DDI Central

ManageEngine DDI Central en versiones inferiores a 6201 es vulnerable a inyección de comandos PowerShell durante la sincronización de registros DNS SPF/TXT en Windows, permitiendo ejecución remota de código. Esta vulnerabilidad (CVSS 8.8) afecta directamente a administradores de infraestructura DNS en organizaciones de LATAM que utilizan esta plataforma para gestión centralizada de DNS. Un atacante podría comprometer servidores DNS altas y obtener control total del sistema.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/09/2026

Inyección de comandos alta en ManageEngine DDI Central < 6201 permite ejecución remota

ManageEngine DDI Central en versiones anteriores a 6201 contiene una vulnerabilidad de inyección de comandos en el campo de nombre de política de resolución DNS de Windows, permitiendo la ejecución remota de código con score CVSS 7.2. Esta afecta directamente infraestructuras DNS gestionadas por empresas en México y Latinoamérica que utilizan esta solución de gestión de direcciones IP. Un atacante podría ejecutar comandos arbitrarios en servidores Windows con permisos del servicio DDI Central.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad de validación en OpenDMARC afecta autenticación de correo en servidores hasta versión 1.4.2

Se ha identificado una falla en Trusted Domain Project OpenDMARC versiones hasta 1.4.2 que permite eludir validaciones de equivalencia en el componente Domain Handler (archivo policy.c). La vulnerabilidad puede explotarse remotamente y afecta la autenticación DMARC de correos electrónicos en servidores de correo, con riesgo de suplantación de dominios. Empresas en LATAM que usan OpenDMARC deben aplicar actualizaciones urgentes, especialmente aquellas que procesan comunicaciones altas.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100833] Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to…

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update accidentally introduced an `allow_storage` rule that accepts storage entries using the `image_guest_pull` driver without verifying the image digest. An attacker with access to the Kata agent API — for example, a …

nvdaltovulnerabilidad CVSS 8.2 NVD