Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81683] openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client privat…

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps onl…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81097] The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylis…

The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded m…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81098] The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller cre…

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch f…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81091] The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mou…

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81093] The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The han…

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neither the host name nor the address it resolves to. Loopback, link-local and priva…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81094] The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only whe…

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to a…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81096] ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that req…

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup o…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-80208] APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in Interna…

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated cli…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-78002] A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow i…

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-75871] GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of t…

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, r…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-5680] A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending speciall…

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-57499] Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vuln…

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-34674] Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulner…

Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30047] A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7…

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30050] An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5g…

An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30057] An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Deni…

An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-19889] GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of t…

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bed…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-16279] An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R…

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad alta en CodeMeter Runtime permite inyección de formato e acceso a memoria

CodeMeter Runtime versiones anteriores a 8.41a y 9.10 contienen una vulnerabilidad de inyección de especificadores de formato printf que permite a atacantes locales y remotos ejecutar denegación de servicio, acceder a memoria del proceso e interceptar canarios de pila. Afecta principalmente a sistemas de licenciamiento y protección de software en empresas de manufatura, energía y servicios financieros de la región.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad de desbordamiento de búfer en CodeMeter Runtime versiones anteriores a 8.41a y 9.10

CodeMeter Runtime, cuando se configura como servidor, es vulnerable a un ataque de lectura fuera de límites (out-of-bounds read) mediante el opcode 0x5e debido a validación insuficiente de longitud de datos. Esta falla causa fallo de segmentación que interrumpe el servicio. Afecta sistemas de licenciamiento de software en empresas manufactureras, de ingeniería y financieras en LATAM que dependen de esta plataforma para protección de activos digitales.

nvdaltovulnerabilidad CVSS 7.5 NVD