Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73654] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller wit…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72675] Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unautho…

Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning fu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72642] The native inference process that Elasticsearch uses to evaluate uploaded machine learning models ac…

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memo…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72643] Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user ide…

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-48099] WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a…

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-19747] A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14…

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17229] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an in…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18164] An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentic…

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18846] IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client dat…

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server (DoS) for that server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17199] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbou…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16982] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a hea…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17004] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an in…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16887] IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16815] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentia…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16868] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the u…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-13460] IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded toke…

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-13365] IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could al…

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73653] Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Br…

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73482] phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/a…

phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logge…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17220] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify a…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

nvdaltovulnerabilidad CVSS 8.2 NVD