Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90843] A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b89…

A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file functions_nmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Th…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90844] A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affe…

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90841] A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by thi…

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be u…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90840] A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the func…

A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91200] DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod…

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91145] Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, al…

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91143] goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allo…

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-12756] IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity …

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-12944] IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root…

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-86917] A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden …

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-84631] This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gat…

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-84568] A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Gol…

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-84553] A resource exhaustion issue was addressed with improved input validation. This issue is fixed in mac…

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-84505] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in mac…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-65414] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected app termination or arbitrary code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-65362] This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Se…

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-65364] An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Gold…

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause unexpected system termination.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-64701] A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia…

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-64712] This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Se…

This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-53713] Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based…

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before is_critical_path evaluates Lua submitted through EnvoyExtensionPolicy during default Strict validation. Linux resolves a double-s…

nvdcriticovulnerabilidad CVSS 9.1 NVD