Alertas de Seguridad de la Información

hMailServer versiones 6.0.0 a 6.3.5 contienen una vulnerabilidad que permite eludir la validación DANE (RFC 7672) en entregas SMTP salientes. El servidor no valida correctamente respuestas DNSSEC incompletas, malformadas o sin pruebas NSEC/NSEC3, permitiendo entregas de correo a destinos no autenticados. Afecta principalmente a proveedores de correo y servidores de mensajería en LATAM que dependen de DNSSEC para seguridad de entrega.

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it neve…

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and Get…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set exclusively by the HTTP-only `TenantMiddleware`, so on the live (WebSocket/SSE) path `get_current_tenant()` was always `None` during mount and…