Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/09/2026

Vulnerabilidad alta en pgweb 0.17.0 permite acceso no autorizado a bases de datos

pgweb versiones hasta 0.17.0 contiene una vulnerabilidad en el endpoint POST /api/connect que permite a atacantes eludir la autorización cuando connect-backend está configurado, proporcionando cadenas de conexión arbitrarias a bases de datos. Los atacantes pueden acceder a bases de datos no autorizadas y servicios internos manipulando identificadores de sesión y URLs de conexión, afectando especialmente infraestructuras de datos en empresas mexicanas y latinoamericanas con configuraciones de autorización insuficientes.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/09/2026

Vulnerabilidad alta en PraisonAI permite ejecución no autorizada de herramientas (CVE-2026-57137)

PraisonAI versiones 1.4.0 a 1.7.2 contienen una falla de control de acceso en createAgentLoop() que ejecuta herramientas antes de validar permisos. Un atacante puede forzar la ejecución de funciones no autorizadas que generen efectos secundarios irreversibles, comprometiendo sistemas de IA generativa en empresas mexicanas y latinoamericanas. El CVSS 8.8 refleja impacto alto en confidencialidad e integridad de datos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/09/2026

Vulnerabilidad crítica en PraisonAI permite ejecución remota de código malicioso

PraisonAI versiones 1.4.0 a 1.7.2 contienen una vulnerabilidad de ejecución de código no autorizado (CVSS 9.9) en el módulo code-mode.ts. Un atacante puede eludir el sandbox de JavaScript utilizando técnicas de prototipado para recuperar el constructor Function real y acceder a process, comprometiendo completamente sistemas que ejecuten agentes multi-IA. Este riesgo afecta directamente a empresas en LATAM que implementan automatización con PraisonAI en entornos productivos.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/09/2026

Vulnerabilidad crítica en PraisonAI permite falsificación de tokens JWT sin autenticación

PraisonAI versiones anteriores a 0.1.6 utiliza una clave HS256 predeterminada y pública cuando las variables de entorno no están configuradas, permitiendo que atacantes sin autenticación firmen tokens JWT arbitrarios. Esta falla afecta a sistemas que ejecuten plataformas de agentes multiequipo en configuraciones de desarrollo accidentalmente expuestas en producción, comprometiendo completamente el control de acceso.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/09/2026

Vulnerabilidad alta en PraisonAI permite ataques de DNS rebinding en sistemas locales

PraisonAI (versiones 0.6.0 a 1.6.59 en praisonaiagents y 3.10.0 a 4.6.59 en PraisonAI) expone endpoints legados /sse y /messages/ sin validación de Host, Origin ni autenticación, permitiendo que sitios maliciosos ejecuten ataques de DNS rebinding contra instancias locales. Afecta especialmente a empresas que ejecutan sistemas multi-agente en infraestructura interna o en la nube privada. El CVSS de 8.3 refleja alto riesgo de compromiso de datos y control remoto.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-57136] PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-t…

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/sandbox-executor.ts validates only the first whitespace-delimited executable against allowedCommands, then SandboxExecutor passes the complete command string to sh -c. A command beginning with an allowed executable can append a non-allowlisted command through shell metacharacters,…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-19515] The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input …

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands o…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-75092] A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided b…

A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identi…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Medio vulnerabilidad

15/09/2026

CVE-2026-69416 Windows DHCP Server Denial of Service Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-69416 Windows DHCP Server Denial of Service Vulnerability. Tipo: Denegación de Servicio (DoS).

windowsdos Microsoft MSRC

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91087] A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_i…

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4b…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-75983] The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is v…

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-91003] A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the …

A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91004] A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted e…

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-91001] A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of t…

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90879] A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown …

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90880] A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function s…

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90858] A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07e…

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function session_start of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This product operates…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90876] A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by th…

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90877] A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this is…

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90852] A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the func…

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issu…

nvdaltovulnerabilidad CVSS 7.3 NVD