Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19300] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information …

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-18658] IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.…

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-18905] IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a …

IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`)

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-19274] IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator coul…

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlle…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19283] IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator coul…

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19298] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2022-35499] In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site …

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85696] SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded …

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85699] jina-ai reader contains a server-side request forgery vulnerability where URL validation is performe…

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85691] MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /…

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85694] LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract…

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute arbitrary code on the operator's host without review.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85695] FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allow…

FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85684] marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler t…

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85685] AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill t…

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85686] ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compa…

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image_url, audio_url, or video_url parameters to make the server issue requests to internal services and cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85687] surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the …

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument, obtaining rendered contents as base64 and using /info as an existence oracle.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85688] TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the …

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system paths, enabling code execution through authorized_keys, cron files, or executable graph files.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85690] Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attacke…

Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to arbitrary locations like shell rc or cron files, achieving code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85671] QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_ba…

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and retrieve base64-encoded files or parsed document chunks without ownership verification to disclos…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85672] zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the…

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occu…

nvdcriticovulnerabilidad CVSS 9.8 NVD