Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

[CVE-2026-17623] IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-17626] IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify…

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-17630] IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to…

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9192] An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11…

An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass password verification and execute queries with the privileges of any named user known to the server, including administrators.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9193] An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Serve…

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9195] A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6…

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-9203] A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 al…

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-7329] An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces o…

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-8709] An improper privilege management vulnerability in the REST API document patch operation of Progress …

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9190] An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 1…

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLo…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-70601] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-70604] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch() or XMLHttpRequest that scheme cross-origin and read the full response …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-39923] Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthe…

Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle() method calls PasswordToken::findOrFail() without performing any expiry validation, allowing attackers to bypass the 24-hour token lifetime enfo…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-15572] A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Al…

A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an all…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-10025] IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML Externa…

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE) injection vulnerability. The vulnerability resides in the parseXmlPayload() function within the event processing pipeline ( q1labs_core.jar ). When at least one log source type is configured to use XML-format property autodetection, the system processes XML-formatted syslog events sen…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-17613] Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowin…

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16102] A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and acc…

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrati…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-15573] A flaw was found in Keycloak's Authorization Services. The component responsible for matching reques…

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-67623] Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to e…

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71294] Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that m…

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a `ci` POST parameter obtained via `cot_import('ci', 'P', 'TXT')` (trim-only sanitization) is passed to `unserialize(base64_decode($ci))` with no `allowed_classes` restriction, reachable by any member with write access to …

nvdaltovulnerabilidad CVSS 7.6 NVD