Alertas de Seguridad de la Información

F Alto vulnerabilidad

10/07/2026

[CVE-2026-55827] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients la…

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write w…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Crítico vulnerabilidad

10/07/2026

[CVE-2026-57156] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, F…

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

10/07/2026

[CVE-2026-57158] FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP …

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-57850] RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, s…

RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope cont…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55789] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's …

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders u…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55377] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's …

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the log…

nvdaltovulnerabilidad CVSS 8.1 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55452] Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the…

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet so…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55466] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. T…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-5801] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP allows Command Line Execution through SQL Injection. This issue affects SEM-PMP: through 23042026.

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Crítico vulnerabilidad

10/07/2026

[CVE-2026-61459] MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools …

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType and name parameters with leading dashes. Attackers can inject the --server flag to redirect kubectl commands to an attacker-controlled API server, causi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61460] Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadControlle…

Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, updat…

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

10/07/2026

[CVE-2026-61461] Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend th…

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-6212] Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc…

Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Privilege Abuse. This issue affects TeraMIS: from V03.26.01.14 through 30.04.2026.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-59151] Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted th…

Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker wi…

nvdcriticovulnerabilidad CVSS 9.6 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55516] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is …

nvdaltovulnerabilidad CVSS 7.7 NVD

C Alto vulnerabilidad

10/07/2026

[CVE-2026-53450] Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects…

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 …

nvdaltovulnerabilidad CVSS 7.4 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-54329] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path m…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 8.5 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55460] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

C Alto vulnerabilidad

10/07/2026

[CVE-2026-53448] Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTT…

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated…

nvdaltovulnerabilidad CVSS 7.2 NVD

H Alto vulnerabilidad

10/07/2026

[CVE-2025-30007] HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-p…

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to premature…

nvdaltovulnerabilidad CVSS 8.8 NVD