Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82432] Description Nimbus validated `topology.blobstore.map` against the calling subject at submission tim…

Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could introduce a blobstore map entry naming a blob whose ACL does not grant them access. Supervisors localise …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82438] Description Three separate mechanisms allowed a web page on an unrelated origin to read responses t…

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's `Origin` header back in `Access-Control-Allow-Origin` while also sending `Access-Control-Allow-Credentials: true`. The published security model documents a permissive `Access-Control-Allow-Origin: *` …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82429] Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker di…

Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an effective uid of 0. Both syscalls re-resolve the path at the time of the call, after FTS has classified the entry, and the trees being walked are owned and writable by the untr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-25687] A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) al…

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90948] A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG i…

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pixel data is written. A remote attacker could exploit this by crafting a malicious ICO file, which, when …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90949] A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection …

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting a malicious PSP file. Opening this file in GIMP could lead to a crash or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90787] A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189…

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might b…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-82441] Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `depend…

Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup of a finished topology, Nimbus deletes the keys named in those lists, and the deletion is perfo…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-73370] Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks…

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks performed by Reconciliation service's pull and push, being incomplete, could accept calls by administrator not provided with adequate entitlements. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-73236] Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks…

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting in incorrect authorization. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-90937] froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowi…

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files during cron rebuild, enabling web server configuration corruption, denial of service, or hijacking of HTTP …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90715] A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unkn…

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity_json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.8 mitigates this issue. The name of the patch is…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-78330] Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings f…

Incorrect privilege assignment vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can obtain admin privileges after completing a successful authentication and obtaining a valid low-privileges JWT. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, fr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-77051] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-77181] Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update…

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are reco…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-73178] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An admi…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests, impersonating users with higher administration entitlements. This issue affects Apache Syncope: fr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-73668] Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitle…

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for. This issue affects Apache Syncope: fr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-75030] Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entit…

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad SSRF alta en Taisan Tarzan-CMS 1.0.0 permite acceso no autorizado

Se identificó una vulnerabilidad de Server-Side Request Forgery (SSRF) en la función openConnection del componente Theme Download Function de Taisan Tarzan-cms versión 1.0.0. Un atacante remoto puede manipular el parámetro httpUrl para ejecutar solicitudes HTTP no autorizadas desde el servidor afectado, comprometiendo la integridad de sistemas internos y datos sensibles. El exploit está disponible públicamente, incrementando el riesgo de explotación inmediata en entornos empresariales de LATAM.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

14/09/2026

Vulnerabilidad crítica en Bifrost permite ejecución remota de código sin autenticación

Bifrost permite registrar clientes MCP a través de su API de gestión sin requerir handshake MCP ni autenticación cuando governance.auth_config.is_enabled=false (configuración por defecto). Un atacante puede ejecutar comandos arbitrarios como el usuario del proceso Bifrost mediante una única solicitud POST /api/mcp/client no autenticada, comprometiendo completamente servidores y gateways en empresas de LATAM que usen esta solución.

nvdcriticovulnerabilidad CVSS 9.8 NVD