Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/09/2026

[CVE-2026-63464] nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before v…

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow_private: true on their own managed webhook subscription (POST/PATCH /api/v1/webhook-subscriptions). No admin check exists on this field. At delivery time, allow_private switches the dispatcher to an unguarded HTTP client, bypassing the priv…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-78222] A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() c…

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-66362] Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection …

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rende…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

31/08/2026

Vulnerabilidad crítica en @hulumi/drift permite ejecución de planes maliciosos sin validación

Las versiones de @hulumi/drift anteriores a 1.3.2 aceptan planes de ejecución externos sin validar su procedencia, permitiendo que entrada de reconciliación no confiable sea tratada como confiable. Atacantes pueden inyectar planes maliciosos que eludan controles de seguridad para ejecutar operaciones de reconciliación no autorizadas, afectando sistemas de procesamiento de datos en empresas de México y LATAM con puntuación CVSS 9.8.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/08/2026

[CVE-2026-82641] keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces with…

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/08/2026

Vulnerabilidad alta en KubeEdge CloudCore 1.23.1 permite falsificación de estado de actualización de nodos

KubeEdge CloudCore versiones hasta 1.23.1 acepta reportes de estado de tareas sin autenticación en puerto 10002, permitiendo a atacantes modificar el estado de trabajos de upgrade. Esto compromete la integridad del plano de control en infraestructuras edge/IoT, siendo alta para organizaciones en LATAM con despliegues en manufactura, utilities y telecomunicaciones que dependen de orquestación automática de actualizaciones.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75121] PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vul…

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_vlan_membership_edit_dialog_post handler incorporates the memberTags POST parameter into a shell command without sanitization. A remote authenticated attacker can send a crafted memberTags value to execute arbitrary operating-system commands on the devi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75122] PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vul…

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75123] PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vul…

PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web credentials can send a crafted SMTP server value to execute arbitrary operating-system c…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75124] PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vu…

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an ove…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-38346] An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd297…

An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-61617] Wings is the server control plane for the Pterodactyl game-server management panel. In versions up t…

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical disk and take down every server on it. Wings checks available space only once, as a boolean, when the …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78465] A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX…

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersize…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-76847] act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actio…

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/art…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73843] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, i…

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods i…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73667] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and …

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -c instead of passing the values through container.env, allowing arbitrary commands to run in workflow p…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72901] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an a…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-63508] Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthori…

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-44945] A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests…

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-52855] Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.…

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.

nvdcriticovulnerabilidad CVSS 9.9 NVD