Alertas de Seguridad de la Información

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-19274] IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator coul…

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlle…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85696] SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded …

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85695] FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allow…

FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85684] marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler t…

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85688] TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the …

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system paths, enabling code execution through authorized_keys, cron files, or executable graph files.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85672] zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the…

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85667] xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints…

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85661] excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unse…

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85663] Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods th…

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-82923] The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or n…

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads di…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85184] @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by m…

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as aut…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85085] The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView…

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-62928] XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injec…

XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-69657] XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the cr…

XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-70403] XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the …

XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-15354] The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,…

The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85504] FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long…

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85506] ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_…

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85507] ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc…

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85508] ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc…

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).

nvdcriticovulnerabilidad CVSS 9.8 NVD