Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52727] lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch…

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-47252] Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INS…

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript. In plugins/chrome/tabs.go, tabsTable.Insert() pas…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-54053] Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the Z…

Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedVault.php accepts archive filenames containing parent-directory traversal segments. An authenticated user can write arbitrary files outside the importing user's vault and into other users' vaults, including overwriting existing files. Disguis…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-86039] libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @lib…

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, a…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-86038] libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @lib…

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRawMessage verifies a signature with attacker-controlled msg.key but skips binding that key to msg.from when the claimed author is an RSA peer ID that does not inline a public key. An…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-81515] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient deserializes the registry response as one unit, and an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp can abort the entire response. A principal that can register or upda…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-81516] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A principal that can register a Consul service can supply a secure value other than true or false, causing …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-63460] Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API al…

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply a catastrophically backtracking pattern through StringOperators.regex. packages/core/src/service/helpers/list-query-builder/parse-filter-params.ts passes the raw pattern to the REGEXP implementation registered by packages/core/src/service/helpers/list-query-b…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-63472] Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.…

Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/src/service/helpers/external-authentication/external-authentication.service.ts selects an existing customer user by emailAddress and attaches a newly presented ExternalAuthenticationMethod without requiring verified to be true. In deployments with a custom exte…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92960] vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configura…

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92953] vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes fr…

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92957] vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-suppl…

vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92958] vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the b…

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can there…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92947] vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host m…

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92948] vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a…

vm2 versions >= 3.9.6 and

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92950] vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to e…

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92951] vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlis…

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92940] vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed cod…

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unr…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92941] vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing a…

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-co…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92946] vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled wi…

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.

nvdcriticovulnerabilidad CVSS 10.0 NVD