Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-55241] Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime,…

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart profileImage uploads through in-memory Multer parsing before registration validation, without file-size, file…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 2 días

Vulnerabilidad alta en MCP Streamable HTTP: Agotamiento de memoria y Denegación de Servicio

El transporte HTTP del servidor MCP Streamable (variantes WebFlux y WebMvc) no limita la cantidad de sesiones que retiene y no requiere autenticación de clientes por defecto. Un atacante remoto puede acumular sesiones ilimitadas, agotando la memoria del servidor y causando Denegación de Servicio (DoS). Esta vulnerabilidad afecta infraestructuras altas en México y Latinoamérica que dependen de aplicaciones Spring Framework.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-17170] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-17163] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an array size field.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-63495] Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebS…

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the pro…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-75140] jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnera…

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers ca…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-73197] A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by se…

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-73198] A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `…

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-50142] libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF…

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation. In libheif/sequences/seq_boxes.cc, Box_stsz::parse() applies max_sequence_frames only to variable-size samples, so fixed-size mode accepts an attacker-controlled sample_count witho…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-47628] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an a…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-73997] Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75050] In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type pa…

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-64868] New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys…

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the payment controllers, allowing an unauthenticated attacker to cause memory pressure, container restart…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-74878] openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection …

openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-74788] Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnera…

Scriban before 7.0.0 (affected versions

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-73060] Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRan…

Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2026-73062] Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multipli…

Scriban versions 3.0.0 through 7.2.0 contain a denial of service vulnerability in the array multiplication operator that allocates memory without enforcing LoopLimit or overflow-safe arithmetic checks. Attackers can supply a large integer multiplier in a template to force multi-gigabyte memory allocations, causing resource exhaustion and availability degradation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-19474] @fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not…

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17199] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbou…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-70464] rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticat…

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module select…

nvdaltovulnerabilidad CVSS 7.5 NVD