Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107286] Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. …

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed requests made through ConcurrencyLimitedModel or limit_model_concurrency can retain shared concurrency slots because anyio.CapacityLimiter associates an acquired slot with the borrowing task while streaming cleanup can run in a different task. Early stream terminat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-14990] IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnera…

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-66479] Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allo…

Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad alta en Progressive Robot hMailServer permite denegación de servicio remota

Una complejidad algorítmica ineficiente en la verificación de firmas DKIM y ARC en Progressive Robot hMailServer 6.0.0 a 6.3.5 permite a atacantes remotos no autenticados saturar servidores de correo mediante mensajes especialmente crafted. El procesamiento de encabezados crece exponencialmente, causando consumo excesivo de recursos y caída del servicio de correo, impactando directamente la comunicación empresarial en organizaciones que dependen de este servidor.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

Vulnerabilidad de denegación de servicio en hMailServer 6.3.0-6.3.5 en Linux por falta de timeouts

Progressive Robot hMailServer versiones 6.3.0 a 6.3.5 en Linux presenta un defecto alta donde falta configuración de timeouts en conexiones de red, permitiendo a atacantes remotos bloquear threads del servidor e interrumpir la entrega de correo saliente. Este problema afecta directamente a servidores de correo empresariales en México y Latinoamérica que utilizan estas versiones en infraestructura Linux, causando degradación severa del servicio de comunicaciones.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-71183] An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain infor…

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authe…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-103646] The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logg…

The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, includi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-17196] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File T…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. Thi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-17609] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the t…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-82627] The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Inc…

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plu…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-76268] In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access t…

In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration op…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-95606] Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows…

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-106557] Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @back…

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-107204] LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows re…

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded __import__, to import os and run operating system commands as the LMCache process.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-46570] In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/in…

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by reading the special crafted file metadata.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-107202] A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API …

A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-106560] Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugi…

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected template and control its repository file location may cause generated content to be written outside the task…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-106558] Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, t…

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-106510] Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugi…

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Thi…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-106556] Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugi…

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build en…

nvdaltovulnerabilidad CVSS 7.7 NVD