Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/09/2026

[CVE-2026-61686] SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveCompon…

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authenticated attacker can supply an arbitrary PHP serialized payload. Version 3.0.1 fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19534] undici's WebSocket client crashes the whole Node.js process during the opening handshake when a serv…

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undici dereferences a null value while checking it against the requested list and throws an uncaught TypeErr…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Informativo vulnerabilidad

04/09/2026

[CVE-2026-18540] undici's retry interceptor can append the body of a ranged retry response to bytes already delivered…

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response …

check-pointcheckpointbajo CVSS 3.7 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2021-44320] Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (D…

Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e., video streaming and control) by using tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding and UDP flooding.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-84961] undici's BalancedPool constructor passes its entire options object through an internal deep-clone th…

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer who…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85152] undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the ca…

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream origin is returned for a request to a different, trusted origin whenever the method, path, and relevant …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-75430] PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP…

PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-18175] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due t…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-18221] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improp…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-18486] IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker…

IBM ContextForge MCP Gateway

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-18489] IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote att…

IBM ContextForge MCP Gateway - Translate utility

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-31020] In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to d…

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulner…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-75431] PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-base…

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-77822] IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive informa…

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-75160] An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via th…

An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-44402] Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in …

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a malicious tar archive containing arbitrary executable files that are extracted to a privileged directory and…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19303] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrar…

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19304] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitiv…

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19305] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information …

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19306] IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from …

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file content…

nvdaltovulnerabilidad CVSS 7.7 NVD