Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106100] Payload is a free and open source headless content management system. In @payloadcms/db-mongodb vers…

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105862] Payload is a free and open source headless content management system. In versions before 3.90.0 and …

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and executes attacker-controlled JavaScript when a user downloads and opens the SVG. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105865] Payload is a free and open source headless content management system. In versions before 3.90.0 and …

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload directory, resulting in data loss or service disruption. Deployments that restrict upload management to truste…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105857] Payload is a free and open source headless content management system. In @payloadcms/plugin-form-bui…

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105858] Payload is a free and open source headless content management system. In versions before 3.90.0 and …

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first-register operation can execute code remotely when local authentication is enabled and no initial user has been created. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105859] Payload is a free and open source headless content management system. In versions before 3.90.0 and …

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-104850] MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. St…

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they b…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-104070] The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows …

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a m…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-76105] Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random …

Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-67270] Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Vali…

Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend administrator credentials.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-67273] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of S…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-70411] Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication fo…

Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-tenant gRPC service (TenantService). An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized creation of tenant entities, cross-tenant role injection, and modification of storage acc…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-61411] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Infor…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-26287] External Secrets Operator reads information from a third-party service and automatically injects the…

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Starting in version 0.10.0 and prior to version 1.3.2, a bug in the `webhook` generator initialization order incorrectly cleared the label-enforcement flag (`EnforceLabels`) after it was set, resulting in the provider-side check for `external-secrets.io/type=webhook` b…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105845] Payload is a free and open source headless content management system. In versions from 3.0.0 before …

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-63692] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Cr…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-67269] Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privile…

Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-54472] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credential…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.9.8

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-61421] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credential…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-63688] Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication f…

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.

nvdcriticovulnerabilidad CVSS 10.0 NVD