Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59892] OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/prop…

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using Jaeger…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59922] Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tild…

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in v…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

08/07/2026

[CVE-2026-59879] Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set,…

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abor…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59887] linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: sch…

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

08/07/2026

[CVE-2026-59261] OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files …

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can expose sensitive data and credentials that should remain within trusted boundaries.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59731] Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions…

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

nvdaltovulnerabilidad CVSS 8.2 NVD

D Alto vulnerabilidad

08/07/2026

[CVE-2026-29008] U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine()…

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() valida…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

08/07/2026

[CVE-2026-29009] U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-…

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing …

nvdaltovulnerabilidad CVSS 8.2 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-39822] On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of th…

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

nvdaltovulnerabilidad CVSS 7.8 NVD

O Alto vulnerabilidad

08/07/2026

[CVE-2025-3110] OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values…

OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy

nvdaltovulnerabilidad CVSS 7.5 NVD

I Crítico vulnerabilidad

08/07/2026

[CVE-2026-9074] IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated …

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

nvdcriticovulnerabilidad CVSS 9.1 NVD

I Alto vulnerabilidad

08/07/2026

[CVE-2026-59880] Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable…

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft ma…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

08/07/2026

[CVE-2026-59725] Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before …

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST requests with Content-Type: application/octet-stream, allowing an unauthenticated attacker to exhaust server-side connections and sockets. This issue is fixed in version 6.6.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

08/07/2026

[CVE-2026-59869] js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0…

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

08/07/2026

[CVE-2026-59873] node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enfor…

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to exhaust disk space and CPU. This issue is fixed in version 7.5.19.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

08/07/2026

[CVE-2026-59874] node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a c…

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed in version 7.5.18.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

08/07/2026

[CVE-2026-59724] Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before …

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-59702] repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that all…

repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.

nvdcriticovulnerabilidad CVSS 9.3 NVD

I Alto vulnerabilidad

08/07/2026

[CVE-2026-3144] IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to …

IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59703] repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthen…

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to a…

nvdaltovulnerabilidad CVSS 7.5 NVD