Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/08/2026

[CVE-2026-62675] Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio…

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_calla…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-62676] Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio…

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. A gated git push or gh write hidden with these forms pro…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-62677] Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio…

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value because omnigent/spec/parser.py stores the value verbatim and omnigent/spec/validator.py does not constrain it. On a runner where OMNIGENT_RUNNER_WORKSPACE is unset, o…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-41449] UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerabilit…

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _run_command function that allows attackers to execute arbitrary commands by injecting shell metacharacters into untrusted data such as usernames, process names, or filenames. Attackers can exploit this vulnerability through crafted evidence inputs, mounted images with hostile filenames, or…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-41450] UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerabilit…

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the _command_collector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can exploit this by crafting malicious filenames or artifact definitions containing shell metacharacters s…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-41451] UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerabilit…

UAC (Unix-like Artifacts Collector) versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse_artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval. Attackers can inject shell metacharacters such as command substitution syntax or semicolons throug…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-55241] Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime,…

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart profileImage uploads through in-memory Multer parsing before registration validation, without file-size, file…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-39909] llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE h…

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH_RECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with attacker-controlled content. Attackers can send RPC requests to trigger re-execution of stored graphs with dangl…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-75932] Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom doma…

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-75933] Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and s…

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-54789] mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x H…

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a val…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-49114] In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the…

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-22681] OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticat…

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, link-local, or cl…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-77087] Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attack…

Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Paperclip locally, uses DNS rebinding to make authenticated API requests and execute commands through the process adapter.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-77814] is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent direct…

is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/images_private/secret.txt is treated as trusted and served by FileResponse, di…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-77815] to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collap…

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is_path_trusted in scripts/iib/api.py while pointing outside that directory, and FileResponse follows the link when serving the response, so a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-62867] Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-62940] Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an i…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `raw.lxc`) are applied without any project restriction enforcement, allowing a restricted project user to escalate to a privileged container and escape to the hos…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-62941] Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an ins…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check (`AllowInstanceCreation`) runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys (including `security.privileged`, `raw.lxc`, `raw.apparmor`) from the source instance are merged AFTER the check pas…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-63125] Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, pr…

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlin…

nvdcriticovulnerabilidad CVSS 9.9 NVD