Alertas de Seguridad de la Información

A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any wa…

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 2.2.5 mitigates this is…

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially ac…

Obot before v0.23.0 (affected versions

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling relea…

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific ve…

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters (for example $(...) command substitution) could be carried into scripts that execute as root on managed macOS hos…

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as alrea…

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.

Una vulnerabilidad crítica (CVSS 9.8) en el despachador de scripts JScript de hMailServer permite a atacantes no autenticados ejecutar código arbitrario con privilegios de servicio. La falla se activa mediante contraseñas manipuladas con secuencias de escape en autenticación SMTP, POP3 e IMAP. Afecta principalmente a servidores de correo en Windows en organizaciones de México y LATAM que usen versiones 6.0.0 a 6.3.3.

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.

CISA emite alerta de seguridad: CISA Adds Two Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2026-88771, CVE-2026-88772.

CISA emite alerta de seguridad: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway. CVEs relacionados: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775.

Se identificó una falla de autenticación en Coolify versiones hasta 4.1.0 en el manejador de configuración de GitHub App, permitiendo bypass de validación del parámetro 'state' en redireccionamientos. La vulnerabilidad es exploitable remotamente y su código de explotación está disponible públicamente. Empresas que usen Coolify como plataforma de despliegue o integración CI/CD deben evaluar inmediatamente su exposición.

heym versiones anteriores a 0.0.91 contienen una vulnerabilidad de escape de sandbox en el motor de expresiones que permite a usuarios autenticados ejecutar código Python arbitrario. Los atacantes pueden manipular expresiones de flujo de trabajo para acceder a funciones del sistema operativo y ejecutar comandos con los permisos del proceso backend, comprometiendo completamente servidores y sistemas de automatización en entornos empresariales.

Heym versiones anteriores a 0.0.53 contienen múltiples vulnerabilidades altas (CVSS 8.8). La más grave permite ejecución arbitraria de código Python mediante eval() sin sandbox en nodos de condición de flujos de trabajo. Cualquier usuario con permisos de edición de flujos o importación de plantillas maliciosas puede ejecutar código con privilegios del proceso backend. Afecta significativamente a empresas en LATAM que utilizan esta herramienta en automatización de procesos altas.

AzuraCast versiones anteriores a 0.23.6 contiene una vulnerabilidad de inyección de código en el campo de contraseña de retransmisión remota que permite a atacantes con permisos de RemoteRelays ejecutar código arbitrario en el proceso Liquidsoap. La falla resulta de una migración incompleta desde el método vulnerable cleanUpString a toRawString, exponiendo servidores de radio en línea a compromisos de integridad, divulgación de claves API internas y disrupciones operacionales.

AzuraCast versiones anteriores a 0.23.4 contiene una vulnerabilidad de inyección de código en el método ConfigWriter::cleanUpString() que no desinfecta correctamente secuencias de interpolación de Liquidsoap. Usuarios autenticados con permisos de Media o Profile pueden inyectar código Liquidsoap arbitrario en configuraciones de estaciones de radio, permitiendo ejecución remota de comandos mediante expresiones #{process.run()} en URLs de listas de reproducción o campos de metadatos. Afecta principalmente a emisoras de radio web y plataformas de streaming en LATAM que usan AzuraCast para gestión de contenido.