Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/09/2026

[CVE-2026-73512] Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36…

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subseque…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-73513] Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36…

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ referenc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-55159] luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with…

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-55897] luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to r…

luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission f…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-58269] Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Pri…

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-49811] Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment …

Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94495] jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemCon…

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94496] jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authe…

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94497] jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints ac…

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94501] jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints…

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tena…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94411] jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoin…

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94412] jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoin…

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94403] A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001…

A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did no…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-63330] Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_rec…

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-49810] Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive …

Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-58491] Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpg…

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-17052] The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_…

The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_se…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94488] Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.…

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a grou…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-62182] KubeEdge is an open source system for extending native containerized application orchestration capab…

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user wit…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-62369] KubeEdge is an open source system for extending native containerized application orchestration capab…

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive in…

nvdaltovulnerabilidad CVSS 8.1 NVD