Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55229] Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libre…

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafted document to cause LibreOffice to automatically retrieve external HTTP(S) resources and local file resources during document conversion, enabling blind SSRF and limited local file disclosure via linked image resource loading. This issue is fixed in v…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

10/07/2026

[CVE-2026-55233] OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds wri…

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker p…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-41154] Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes thro…

Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-45203] Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmwar…

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

10/07/2026

[CVE-2026-55827] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients la…

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating bitmap->data only for the smaller DstWidth and DstHeight in gdi_Bitmap_Decompress, allowing a malicious RDP server to trigger a heap out-of-bounds write w…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Crítico vulnerabilidad

10/07/2026

[CVE-2026-57158] FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP …

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a malicious RDP server to send a truncated RDPGFX_CMDID_WIRETOSURFACE_1 planar payload that reads one byte past the input buffer. This issue is fixed…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-57850] RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, s…

RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope cont…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55789] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's …

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders u…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55377] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's …

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the log…

nvdaltovulnerabilidad CVSS 8.1 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55452] Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the…

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet so…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55466] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. T…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-5801] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP allows Command Line Execution through SQL Injection. This issue affects SEM-PMP: through 23042026.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61460] Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadControlle…

Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, updat…

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

10/07/2026

[CVE-2026-61461] Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend th…

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

10/07/2026

[CVE-2026-53450] Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects…

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-peers is enabled, but the default loopback guard can be bypassed by using the IPv4-mapped IPv6 peer address ::ffff:127.0.0.1 in a TURN XOR-PEER-ADDRESS attribute. ioa_addr_is_loopback checks for the literal IPv6 loopback shape before IPv4-mapped IPv6 …

nvdaltovulnerabilidad CVSS 7.4 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-54329] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path m…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 8.5 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55460] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

H Alto vulnerabilidad

10/07/2026

[CVE-2025-30007] HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-p…

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_valid() combined with unsafe eval-based parsing in update_domain_zone() to premature…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56667] ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and S…

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reach…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56668] ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exch…

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token belongs to the requesting client or that requested scopes remain within the original token's scopes, allowing a low-privilege token to be exchanged for elevated permissions at another application…

nvdaltovulnerabilidad CVSS 8.1 NVD