Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-64203] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-64204] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-59189] OpenEXR is the reference implementation and specification for the EXR image format, widely used in t…

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.12, the documented TypedDeepImageChannel::row() API can return an out-of-bounds pointer when a deep image has a non-zero dataWindow origin, resulting in a heap out-of-bounds read and crash, with potenti…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-59184] OpenEXR is the reference implementation and specification for the EXR image format, widely used in t…

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row() return an invalid heap pointer, causing out-of-bounds or use-after-free writes. This occurs when an application wr…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-59186] OpenEXR is the reference implementation and specification for the EXR image format, widely used in t…

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read through the public TiledRgbaInputFile RGBA API. The file uses a small 40x40 dataWindow but a 65537x65537 …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-59187] OpenEXR is the reference implementation and specification for the EXR image format, widely used in t…

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occurs with pixel conversion options such as --pixelmode float or --bench because DeepSlice requests FLOAT o…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55553] urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other re…

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or dig…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55571] djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sends a `{"type":"navigate","to":...}` frame when login_required, permission_required, or a redirecting on_mount hook denies a LiveView mount, but returns without closing the WebSocket or clearing self.view_instance. A browser follows the redi…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55585] QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, to…

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parse_expr() without restricted global_dict and local_dict namespaces, allowing Python eval() to resolve builtins and execute arbitrary P…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-47626] NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could …

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-24169] NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated …

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-24170] NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where a…

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-24262] NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could …

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-24263] NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could …

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-19913] The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to …

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the clie…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-16233] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-16234] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79784] Vocos instantiates a class named by a configuration file without restricting which class may be name…

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79774] Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability …

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), an…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-79675] NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in th…

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD