Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-104073] NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allow…

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API to…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-102322] Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote at…

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106115] ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocate…

ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106117] ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group…

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106110] ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocate…

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited fro…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-101207] Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains a…

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-95140] kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java…

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106102] Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.…

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. A…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106218] In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the serv…

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106100] Payload is a free and open source headless content management system. In @payloadcms/db-mongodb vers…

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105862] Payload is a free and open source headless content management system. In versions before 3.90.0 and …

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105857] Payload is a free and open source headless content management system. In @payloadcms/plugin-form-bui…

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105858] Payload is a free and open source headless content management system. In versions before 3.90.0 and …

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105859] Payload is a free and open source headless content management system. In versions before 3.90.0 and …

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-104850] MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. St…

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they b…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-76105] Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random …

Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-67270] Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Vali…

Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend administrator credentials.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-67273] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of S…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-70411] Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication fo…

Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage acc…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-61411] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Infor…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

nvdaltovulnerabilidad CVSS 7.7 NVD