Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-64201] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-64202] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-64203] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-64204] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55571] djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sends a `{"type":"navigate","to":...}` frame when login_required, permission_required, or a redirecting on_mount hook denies a LiveView mount, but returns without closing the WebSocket or clearing self.view_instance. A browser follows the redi…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55585] QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, to…

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parse_expr() without restricted global_dict and local_dict namespaces, allowing Python eval() to resolve builtins and execute arbitrary P…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-47626] NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could …

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-24262] NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could …

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-24263] NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could …

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-16233] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-16234] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79784] Vocos instantiates a class named by a configuration file without restricting which class may be name…

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79770] Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the …

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-55546] QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() i…

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify_math_expression() in src/qwed_mcp/engines/math_engine.py passes attacker-controlled expression and claimed_result strings directly to SymPy's parse_expr() after only normalizing caret syntax to Python exponent syntax, without restricting global_dict, removing Python built-ins, or validating the expression AST. Because…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55581] mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0…

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executables, while security.go validates only the first token and checkBlockedPatternsAndCommands does not reject the shell command-mode flag -c. A caller of the shell_exec MCP tool can provide the command argument `/bin/bash -c

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55582] mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0…

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default security.yaml allows /usr/bin/git, while security.go omits ! from containsShellMetacharacters and containsDangerousShellConstructs and applies no per-executable argument policy. A caller of the shell_exec MCP tool can provide the command argument /usr/bin/git -c alias.pwn=!

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2025-71407] Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD …

Nokogiri before 1.18.3 contains a stack buffer overflow vulnerability in libxml2 when reporting DTD validation errors with long QName prefixes, and a use-after-free vulnerability during validation against untrusted XML Schemas. Attackers can trigger these vulnerabilities by providing malicious DTD content or untrusted XSD files to cause denial of service or potential code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2022-50999] Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer…

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2022-51000] Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libx…

Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via CVE-2022-23308 in libxml2, an application parsing an untrusted document with parse option DTDVALID set t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-69104] An authenticated user may initiate repository migration operations without required repository permi…

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.

nvdaltovulnerabilidad CVSS 7.6 NVD