Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-107205] LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinato…

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite quotas via /quota endpoints, inject events via /events, and enumerate /directory/keys to disrupt cachin…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-107206] LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP …

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration via GET /config, clear caches, delete cache objects, and modify tenant quotas to evict other tenants' c…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-107207] LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitorin…

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach internal hosts, read responses, and tamper with nodes or stop the heartbeat.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-77214] libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_Par…

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching t…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-46570] In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/in…

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-107202] A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API …

A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106560] Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugi…

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106558] Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, t…

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106510] Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugi…

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Thi…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106556] Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugi…

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build en…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2025-70521] The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not hand…

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2025-70518] The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not hand…

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2025-70516] The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authenticati…

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-46572] In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.…

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-46434] wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the …

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequired…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-107183] llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_m…

llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-42618] In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that al…

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-43976] wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management v…

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-42617] In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows …

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-107181] Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sand…

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.

nvdaltovulnerabilidad CVSS 8.1 NVD