Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59734] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and health_check_path parameters into shell commands without proper sanitization, allowing authenticated users to execut…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59221] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 bef…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal value to pass normalization checks and be decoded by the upstream terminal server. This issue is fixed in version 0.10.0.

nvdaltovulnerabilidad CVSS 7.7 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-55420] Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5…

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to obtain RCE on the server. This issue is patched in 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-58378] Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker cou…

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59224] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbo…

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59214] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and ex…

nvdaltovulnerabilidad CVSS 7.3 NVD

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59216] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the session was connected, allowing authenticated users who learned another socket ID through ydoc:document:join to run code interpreter Python or tools in that user …

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59219] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 bef…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels, join-note, and the terminal websocket first-message authentication used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating realtime connections. This is…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51605] A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.…

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51606] An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91)…

An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

09/07/2026

[CVE-2026-58459] gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in …

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot plot title without proper escaping. The subtype field sourced from a DEVICES JSON log entry or NMEA PGRMT sentence is written into a generated gnup…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51603] A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.…

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted second SETUP request. After completing the OPTIONS, DESCRIBE, and a legitimate first SETUP request to obtain a valid session ID, the RTSP service's second-stage URL routing parser fails to validate the length of…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51604] A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.…

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51600] Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP request…

Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods). When a request carrying a Content-Length header is received without a corresponding message body, the RTSP parser enters a persistent body-awaiting state, causing the affected TCP connection to become permanently non-functional. The device does not ac…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51601] Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The d…

Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request. An unauthenticated remote attacker who has completed a standard RTSP session handshake can send a PLAY request with an excessively long clock= value to cause the RTSP service to crash.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51602] A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.…

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the first SETUP request. By supplying a URL consisting of exactly four consecutive repetitions o…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-15308] The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeat…

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-13462] PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows inva…

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15190] A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affect…

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of the file /login.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

N Alto vulnerabilidad

09/07/2026

[CVE-2026-59206] n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authe…

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fi…

nvdaltovulnerabilidad CVSS 7.1 NVD