Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/09/2026

[CVE-2026-88064] Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until…

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the docum…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-63671] MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. …

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowDangerousHtml enabled by default and relies on validateProps, validateProp, and unsafeLinkPrefix to remove executable URLs from untrusted Markdown. validateProp checks only attributes named href or src, allowing an SVG xlink:href value repres…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89782] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table …

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() indexes the transaction table by the transact_id taken from the log record header. check_log_rec() only verifies that transact_id is non-zero and properly aligned, not its magnitude, so a crafted image can request an arbitrarily la…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-76866] Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplie…

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments executed with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-61560] `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the S…

`@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local filesystem via an unsanitized `file_path` parameter and uploads them to a GitLab project. Combined, any unauthenticated network-reachable attacker…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-12351] IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0…

IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 could allow a remote attacker to execute arbitrary code due to unsafe JNDI lookup processing when the IVT application is deployed.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-11729] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code in client applications due to unsafe deserialization that enables JNDI injection attacks.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/09/2026

Vulnerabilidad alta en Polyaxon 2.16.4: ejecución de código arbitrario vía Jinja2 sin sandbox

Polyaxon versiones hasta 2.16.4 procesa campos de especificación de operaciones con un entorno Jinja2 sin aislamiento durante la preparación de ejecuciones en servidor. Usuarios autenticados pueden inyectar payloads Jinja2 en campos de cola, namespace, condiciones, presets o dependencias para ejecutar comandos del sistema operativo con privilegios del proceso scheduler, comprometiendo credenciales de bases de datos y datos sensibles. Afecta principalmente a plataformas MLOps y orquestación de contenedores en infraestructuras en la nube.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-19816] A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions car…

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role == REPO_REMOVE || !SIMULATE), which is always true for RepoRemove. An unprivileged local user can therefore perform a ge…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-61701] Laravel MagicLink creates links for authentication without a password or for accessing private conte…

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magic_links.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php without sufficient integrity protection, while an unsafe legacy unserialize() fallback remains reachabl…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-77051] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-82232] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/09/2026

Vulnerabilidad alta de desbordamiento de búfer en SIPp 3.7.7 y versiones anteriores

SIPp versiones hasta 3.7.7 contiene un desbordamiento de búfer en la función get_header() que permite a atacantes no autenticados enviar mensajes SIP con encabezados superiores a 20,490 bytes para causar crasheo del proceso. Esta vulnerabilidad afecta servidores VoIP y sistemas de prueba de telefonía en infraestructuras empresariales de LATAM. El impacto incluye negación de servicio en infraestructuras de comunicaciones altas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/09/2026

Vulnerabilidad de denegación de servicio en Nodemailer 9.1.0 a 10.0.4 (CVE-2026-90776)

Nodemailer versiones 9.1.0 a 10.0.4 contienen una vulnerabilidad de complejidad cuadrática en el parser de direcciones que procesa comentarios RFC 5322. Atacantes pueden enviar encabezados de correo malformados para consumir CPU excesiva y bloquear el event loop de Node.js durante varios segundos, generando negación de servicio. Afecta especialmente a plataformas de notificaciones y sistemas de correo transaccional en LATAM que procesan volúmenes altos de mensajes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/09/2026

Vulnerabilidad alta de desbordamiento de búfer en SIPp 3.7.7 y anteriores

SIPp versiones hasta 3.7.7 contiene un desbordamiento de búfer en la función get_peer_tag() al procesar encabezados SIP con parámetros de etiqueta superiores a 2048 bytes. Atacantes no autenticados pueden enviar mensajes SIP manipulados para causar el bloqueo de procesos en servidores de comunicaciones VoIP y telefonía empresarial. Este riesgo afecta infraestructuras de telefonía en la nube y sistemas PBX que implementen SIPp.

nvdaltovulnerabilidad CVSS 7.5 NVD

C Informativo vulnerabilidad

11/09/2026

[CVE-2026-89567] In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by e…

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint li…

check-pointcheckpointbajo CVSS 0.0 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-71644] An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef12345678…

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missing default case in the FSM that stops publishing swarm trajectories when the drone enters IDLE

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-15462] The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields'…

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-45768] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-73694] FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinitio…

FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through…

nvdaltovulnerabilidad CVSS 7.2 NVD