Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/09/2026

Vulnerabilidad alta en PraisonAI permite ataques de DNS rebinding en sistemas locales

PraisonAI (versiones 0.6.0 a 1.6.59 en praisonaiagents y 3.10.0 a 4.6.59 en PraisonAI) expone endpoints legados /sse y /messages/ sin validación de Host, Origin ni autenticación, permitiendo que sitios maliciosos ejecuten ataques de DNS rebinding contra instancias locales. Afecta especialmente a empresas que ejecutan sistemas multi-agente en infraestructura interna o en la nube privada. El CVSS de 8.3 refleja alto riesgo de compromiso de datos y control remoto.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-57136] PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-t…

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters,…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-19515] The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input …

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands o…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-75092] A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided b…

A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identi…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Medio vulnerabilidad

15/09/2026

CVE-2026-69416 Windows DHCP Server Denial of Service Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-69416 Windows DHCP Server Denial of Service Vulnerability. Tipo: Denegación de Servicio (DoS).

windowsdos Microsoft MSRC

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91087] A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_i…

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4b…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-75983] The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is v…

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-91003] A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the …

A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91004] A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted e…

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-91001] A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of t…

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90879] A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown …

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90880] A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function s…

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90858] A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07e…

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function session_start of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This product operates…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90876] A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by th…

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90877] A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this is…

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90852] A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the func…

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90854] A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. …

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90855] A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This …

A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90856] A security vulnerability has been detected in SourceCodester College Notes Gallery Management System…

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.php of the component Registration Flow. Such manipulation of the argument role leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90849] A security vulnerability has been detected in SourceCodester College Notes Gallery Management System…

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD