Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82432] Description Nimbus validated `topology.blobstore.map` against the calling subject at submission tim…

Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could introduce a blobstore map entry naming a blob whose ACL does not grant them access. Supervisors localise …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-82435] Description The worker's Netty message decoder is installed ahead of the SASL authentication handle…

Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place. It allocated buffers sized from a length field carried in the frame, so a single frame from an unauthenticated peer able to reach a worker slot port could drive a large allocation. `storm.messaging.netty.authentication…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82438] Description Three separate mechanisms allowed a web page on an unrelated origin to read responses t…

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's `Origin` header back in `Access-Control-Allow-Origin` while also sending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive `Access-Control-Allow-Origin: *` …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82427] Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each b…

Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both `AsyncLocalizer` and `Container.createBlobstoreLinks`, and the symlink helper force-deletes whatever already exists at the target before creating the link. A s…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82428] Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key…

Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader caught `KeyAlreadyExistsException` and silently reused it, with no check that the existing blob's c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82429] Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker di…

Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the entry, and the trees being walked are owned and writable by the untr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82430] Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes …

Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened without `O_NOFOLLOW` and without re-verifying its owner, so between the ownership change and the read…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57126] PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url …

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasse…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57129] PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_fi…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, k…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57130] PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/prais…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/email_tools.py interpolates LLM-controlled from_addr, subject, and query values directly into quoted IMAP SEARCH criteria. Embedded quote, backslash, newline, or null characters can escape the intended criterion and alter IMAP operations when search_emails, reply_email, or archive_e…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-59569] An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allow…

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-59570] On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler…

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-25687] A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) al…

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-57123] PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and…

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-57125] PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the u…

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.59 and praisonaiagents 1.6.59, the unauthenticated POST /api/v1/runs Jobs API accepts attacker-controlled agent_yaml, and the approve field can mark execute_command as YAML-approved before @require_approval checks critical tools. This chain allows a remote caller to cause a configured language model agent to invoke arbitrary operating…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90948] A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG i…

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90949] A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection …

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90787] A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189…

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might b…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-82439] Description The DRPC server kept a map from function name to request queue and created an entry the…

Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen. No code path ever removed an entry: request cleanup removed the request from its queue, and the shutdown path drained queues, but the queue object and its map entry remained for the life of the process. Function names come from the client and are not constraine…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-82441] Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `depend…

Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup of a finished topology, Nimbus deletes the keys named in those lists, and the deletion is perfo…

nvdcriticovulnerabilidad CVSS 9.1 NVD