Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/09/2026

[CVE-2023-54402] iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allow…

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authentication. Attackers can exploit the unrestricted URL scheme handling, including file:// URIs, to read arbitrary local files such as operating-system and application con…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-62308] Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6,…

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostna…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-102267] PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is …

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configured trusted JWKS endpoint returns an attacker-influenced redirect. As a result, PyJWKClient follows the redirect and consumes the redirected response as key material. Consequently, f…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-55160] Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-S…

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints (e.g. AWS IMDS 169.254.169.254). When self-service signup is enabled (Setting::UserSignup),…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-55096] fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_…

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by _validate_url_security, an SSRF denylist that checks the URL's literal hostname string but never resolves DNS. The fetch (httpx.AsyncClient.get) …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-82375] Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-ed…

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author s…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101005] A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalI…

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrad…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-100909] A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the funct…

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-100901] A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerabili…

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Commit 6ffe823 'better security for public/stream.php' only added CU…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-100893] A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects t…

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the component open_graphic_parse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vend…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101064] Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server regist…

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101059] utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specification…

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL va…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101060] python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommuni…

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and ret…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/09/2026

Vulnerabilidad alta en AzuraCast anterior a 0.23.8: SSRF y lectura de archivos locales

AzuraCast antes de la versión 0.23.8 contiene vulnerabilidades de Server-Side Request Forgery (SSRF) y lectura de archivos locales en el módulo AutoDJ de obtención de playlists remotas. Un usuario con permisos de Media en la estación puede crear playlists con URLs remotas que apunten a rutas file:// o direcciones internas (loopback/link-local), exponiendo información sensible del servidor. Afecta principalmente a emisoras de radio online y plataformas de streaming en LATAM que utilizan este software para automatizar contenido.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

27/09/2026

Vulnerabilidad alta en AzuraCast permite acceso a recursos de red restringidos

AzuraCast (versión anterior a 0.23.8) presenta una falla en la validación de URLs de retransmisión remota que permite a usuarios con permisos limitados apuntar a direcciones internas (loopback y redes privadas). Esta vulnerabilidad afecta principalmente a proveedores de streaming y radios en línea que operan la plataforma en entornos corporativos compartidos en México y Latinoamérica.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/09/2026

Vulnerabilidad de validación de URLs en AzuraCast anterior a 0.23.8 (CVE-2026-100849)

AzuraCast, plataforma de gestión de radio web autohospedada, contiene un fallo en la validación de URLs de webhooks que permite eludir restricciones de acceso a direcciones internas. La función AbstractConnector::getValidUrl() solo rechaza direcciones link-local, permitiendo ataques SSRF contra redes RFC1918 y loopback. Radiodifusoras y proveedores de streaming en LATAM que usen conectores Generic o Discord están expuestos.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100705] Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (16…

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128) and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legacy apiCall service executor (pkg/engine/apicall/executor.go) or to the GlobalContextEntry external-API…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100697] Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.…

Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL (for example http://127.0.0.1:18089), causing the Adminer server to issue an HTTP POST contain…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100567] OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and …

OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions >= 2026.4.5 and < 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol (CDP) hostname, but the raw WebSocket and Playwright transports performed a later, independent DNS resolution, discarding the DNS pinning enforced at validation time. An attacker who con…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100555] OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology…

OpenClaw is an npm-distributed gateway application. In versions >= 2026.7.1 and < 2026.8.1, Synology Chat attachment delivery could lose DNS pinning: the Gateway validated a single DNS result for a supplied file URL but then passed the original hostname to the Synology NAS, where it could resolve to a different destination. When attachment delivery accepted a remotely influenced hostname, an attac…

nvdaltovulnerabilidad CVSS 7.1 NVD