Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66793] A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Man…

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-16139] In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zon…

In Progress ShareFile Storage Zones Controller versions

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19826] A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian…

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any fu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73658] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResourc…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-59109] SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in re…

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Da…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-49827] WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1…

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chai…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73418] NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 an…

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the exported getToken() helper in the next-auth/jwt and @auth/core/jwt modules can throw an uncaught exception when it reads a malformed Authorization: Bearer header. When no session cookie is present, getToken() URL-decodes the bearer value before validating it, and malformed perce…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-69106] A low-privileged user may poison cached artifact metadata under specific conditions, potentially cau…

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-70313] Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose…

Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-65811] Improper input validation in Power BI allows an authorized attacker to execute code over a network.

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-63520] Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute …

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-61363] Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code …

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-59134] Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code …

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-21273] is affected by an Improper Input Validation vulnerability that could result in privilege escalation.…

is affected by an Improper Input Validation vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-21279] is affected by an Improper Input Validation vulnerability that could result in a Security feature by…

is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-48056] Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions p…

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the  run-download  IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-71217] A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted cont…

A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72867] Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomp…

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trig…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica en Kata Containers permite ejecución de código en el host

Kata Containers anterior a versión 4.0.0 es vulnerable a ejecución de código en el host mediante anotaciones de configuración sin validar. Un atacante puede especificar una ruta TOML arbitraria a través de la anotación io.katacontainers.config_path para cargar archivos maliciosos del host. Esta vulnerabilidad afecta infraestructuras containerizadas en datacenters y plataformas cloud de empresas LATAM que ejecuten orquestación con Kubernetes.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62295] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the JSON utility parser in org.hl7.fhir.utilities.json.parser.JsonParser enforces no maximum nesting depth for arrays or objects. As a result, a small but deeply nested, syntactically valid FHIR JSON document can trigger unbounded readArray() or readObject() recursion, raising …

nvdaltovulnerabilidad CVSS 7.5 NVD