Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87877] zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and…

zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87822] t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingD…

t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87823] zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size …

zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87824] zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect…

zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87825] zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a d…

zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corrupti…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-26212] Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulne…

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86770] Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowi…

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML,…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86771] Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF gene…

Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or externa…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86762] Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware gro…

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86759] Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any a…

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86750] Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before …

Snipe-IT versions

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86751] Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing auth…

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via file_get_contents or curl, exfiltrati…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86754] Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allo…

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions lasting up to 40 years.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86741] Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in …

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credent…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86201] PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing whe…

PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknown clientData JWT properties cause excessive logging without sanitization. Attackers can send crafted LoginPackets with deeply nested or massive object structures to trigger out-of-memory conditions and crash the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86099] Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowin…

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86199] PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline …

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-56711] VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the…

VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2024-58381] PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processin…

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2024-58382] league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdo…

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes.

nvdaltovulnerabilidad CVSS 7.5 NVD