Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-26287] External Secrets Operator reads information from a third-party service and automatically injects the…

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` b…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105845] Payload is a free and open source headless content management system. In versions from 3.0.0 before …

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-63692] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Cr…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-67269] Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privile…

Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-54472] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credential…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-61421] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credential…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-63688] Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication f…

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.

nvdcriticovulnerabilidad CVSS 10.0 NVD

G Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105793] Vulnerabilidad Android en Android Framework - CVSS 9.1

Vulnerabilidad de seguridad en Android (Android Framework): Vulnerabilidad de seguridad en Android. CVSS: 9.1. Afecta dispositivos Android, 80%+ del mercado movil en Mexico y LATAM. Actualiza tu dispositivo en Ajustes - Actualizacion del sistema.

google-androidseguridad-movilandroid-framework CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105796] Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP …

Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and place attacker-controlled OpenAPI text outside a generated documentation comment. The Java sanitizer also removes non-ASCII characters after del…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105791] Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. P…

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the bash_command parameter and permits explorer.exe. On Windows, explorer.exe delegates its following path argument to ShellExecute, so an attack…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-104069] HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() wh…

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it u…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-91140] An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Prog…

An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-85523] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-77178] Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host …

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106038] Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allo…

Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-delete any object via Remove, RemoveByRegex, RemoveAll and BatchRemove on the coro_rpc port. Attackers can send forged requests with the force flag set to bypass lease checks, wipe keys matching any regex, or clear the entire store, causing cache loss and reques…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105839] libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allow…

libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflow via crafted track counts. Attackers can supply an OKT module whose SLEN chunk wraps the 16-bit numtrk value, causing PBOD writes past allocated track pointers for crashes or code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105841] lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe…

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105920] A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e96643…

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product use…

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

Hace 3 días

[CVE-2026-105788] Vulnerabilidad Android en Android Framework - CVSS 8.8

Vulnerabilidad de seguridad en Android (Android Framework): Vulnerabilidad de seguridad en Android. CVSS: 8.8. Afecta dispositivos Android, 80%+ del mercado movil en Mexico y LATAM. Actualiza tu dispositivo en Ajustes - Actualizacion del sistema.

google-androidseguridad-movilandroid-framework CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105837] libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that …

libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load() in load_dsm.c that allows attackers to trigger heap buffer overflow via crafted track counts. Attackers can supply a DSM module whose numchn and numpat product wraps a 16-bit value, overwriting heap memory to cause crashes or potential code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD