Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/09/2026

[CVE-2026-55691] The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and variou…

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedHtmlFormatter::toHtml in includes/EmbedService/EmbedHtmlFormatter.php passes the user-supplied class value directly to sprintf while constructing a figure element. A quote in the class value can termina…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-55692] The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and variou…

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with the default $wgEmbedVideoRequireConsent configuration enabled, includes/EmbedService/EmbedHtmlFormatter.php places JSON returned through includes/EmbedService/AbstractEmbedService.php into the data-mw-i…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-55149] Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior t…

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the auth_request module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to make([]string, numParts) without checking that the value is positive or reasonably bounded. Requests to /validate and /_external-auth-:id reach JWTCacheHandl…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-53710] MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to …

MCP Context Forge is an AI gateway, registry, and proxy for MCP, A2A, REST, and gRPC APIs. Prior to 1.0.2, the python_sandbox_server in mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py exposes raw getattr through safe_builtins, omits a required _getattr_ guard, and relies on validate_code checks for literal dangerous dunder strings. An attacker can construct dun…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-19780] Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attac…

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string befo…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2024-58385] Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php…

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2023-54398] Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.fi…

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doAction method, which passes raw HTTP request body data directly to ObjectInputStream.readObject() without f…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91989] atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP serve…

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91990] Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that…

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91985] Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share …

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91988] atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry back…

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91972] Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints…

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91973] Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints t…

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91964] FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request…

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution w…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91965] WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php …

WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticated attackers can retrieve restricted live transmission details including stream keys, titles, descriptions, owner information, and direct HLS playback URLs by accessing these endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91955] FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during…

FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in multifragment update capability calculations, terminating the server process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91947] FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser t…

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91948] FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static vi…

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-91949] FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allow…

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91941] Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrap…

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.

nvdaltovulnerabilidad CVSS 7.5 NVD