Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93758] An insecure direct object reference in the nested attributes handling of the Mongoid object-document…

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This ma…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-93765] Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-docum…

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field update. This may result in unintended removal of stored records and in the embedding application becomin…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93559] A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0…

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attack remotely. The reported GitHub issue was closed automatically due to inactivity.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-91149] A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by in…

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-85497] CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password has…

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-81321] CM2507 IP cameras store configured wireless network credentials in cleartext within the device files…

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-77239] WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and aut…

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-77240] WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_updat…

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_account_sharing.sql permits authenticated users to modify their own account_role and account_id, allowing a viewer to self-promote or move into another tenant and then access or modify tenant resources. Separately, match_ai_knowledge_fts and mat…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-77301] adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1,…

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and decompression result. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing Buffer.alloc and decompres…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61833] zot is a container image and artifact registry based on the Open Container Initiative Distribution S…

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandl…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61548] Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstruc…

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action usi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61672] Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenList…

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When an administrator's forbidden list mixes capitalized and lowercase keys or otherwise has different case-insensitive and byte ordering, th…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-46655] virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Vi…

virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual de…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-58197] ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol s…

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malici…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93690] uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function th…

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93687] braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack …

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93688] SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails …

SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allowing unbounded transfer state allocation. Unauthenticated attackers can reach the decode engine's POST /generate endpoint and submit arbitrary bootstrap_room values to exhaust prefill process memory until out-of-memory termination.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-88259] CareCam CM2507 IP cameras do not require authentication for access to its network video streaming se…

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-86520] Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time da…

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84398] CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF manage…

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-profile, and stream configuration information.

nvdaltovulnerabilidad CVSS 7.5 NVD