Alertas de Seguridad de la Información

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-34265] SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors i…

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-44758] SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to subm…

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44763] SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient …

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the i…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-8718] tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles g…

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72914] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14,…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-73030] unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_w…

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72910] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/pu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72911] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inje…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72903] Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious …

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() use POSIX path processing that preserves the backslashes as ordinary filename characters. In tabby-ssh/src/components/sftpPanel.component.ts, downloadFold…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-63622] A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm…

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18947] A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /mat…

A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. This allows an unauthenticated remote attacker, or any authenticated user, to trigger a full re-materialization of all feature views. The cons…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-18948] A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored i…

A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the regis…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18949] A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the da…

A flaw was found in odh-dashboard. This vulnerability allows an attacker, who has compromised the dashboard's Service Account (SA) token, to exploit overly broad permissions granted to the SA. This enables the attacker to escalate their privileges to cluster-administrator level, gain access to sensitive data like credentials and keys across the entire cluster, and disrupt multi-tenant isolation.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18950] A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerabilit…

A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are created. The system does not properly validate the `roleRef` field, allowing a user to specify an arbitrary role, including highly privileged ones like `cluster-admin`. This can lead to privilege escalation, where an attacker gains unauthorized elevated access withi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18982] A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit…

A flaw was found in the RHOAI training-operator. This vulnerability allows a user with standard edit or admin roles in any Kubernetes namespace to escalate their privileges. Through the creation of training jobs, an attacker can impersonate service accounts, access the host filesystem, and potentially execute arbitrary code remotely. This issue arises from the aggregation of training job permissio…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18617] A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vul…

A flaw was found in the Data Science Pipelines Operator (DSPO). A namespace editor can exploit a vulnerability in the spec.database.customExtraParams field, which allows for the injection of dangerous parameters into the MySQL Data Source Name (DSN) string. By manipulating these parameters, an attacker can enable LOCAL INFILE functionality and exfiltrate sensitive files, such as the service accoun…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18618] A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making…

A flaw was found in ml-metadata. The statically-linked gRPC stack in ml-metadata is outdated, making it vulnerable to known HTTP/2 denial of service (DoS) issues. An in-cluster attacker, with network access to the MLMD pod, could exploit these vulnerabilities by sending specially crafted HTTP/2 requests. This could lead to a denial of service by crashing the MLMD pod, disrupting all pipeline runs …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18620] A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper au…

A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount function. By specifying a more privileged ServiceAccount (SA) during a CreateRun request, an attacker can bypass authorization checks. This allows the tenant to run their containers with elevated privileges, potentially leading to the disclos…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18621] A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can b…

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18941] A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and t…

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "no_auth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints. A remote attacker, by exploiting this missing authentication, could achieve remote code execution (R…

nvdaltovulnerabilidad CVSS 7.7 NVD