Alertas de Seguridad de la Información

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-82973] Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox befo…

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100818] Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in F…

Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100819] Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was f…

Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100811] Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed…

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100800] Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was…

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100804] Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was f…

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Firefox 157.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100786] Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Fire…

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100778] Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed…

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100770] Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was…

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100762] Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was…

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

Vulnerabilidad crítica de autenticación en Hitachi Energy RTU500 permite carga de firmware no autorizada

Se ha identificado una vulnerabilidad de omisión de autenticación (CVE-2026-8065, CVSS 9.1) en el endpoint de actualización de firmware de Hitachi Energy RTU500 que permite a atacantes no autenticados cargar firmware malicioso mediante solicitudes POST modificadas. La explotación exitosa podría comprometer la funcionalidad operativa, integridad y disponibilidad del dispositivo, afectando principalmente infraestructuras críticas de energía, agua y telecomunicaciones en LATAM que dependen de estos controladores RTU.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

Vulnerabilidad crítica de traversal de directorios en Hitachi Energy RTU500 permite escritura de archivos arbitrarios

Una vulnerabilidad de traversal de directorios en la funcionalidad de carga de archivos del Hitachi Energy RTU500 permite a atacantes no autenticados escribir o sobrescribir archivos arbitrarios en el sistema de ficheros del dispositivo. La explotación exitosa podría resultar en modificación no autorizada de datos críticos de control o interrupción de operaciones en plantas de generación, subestaciones y sistemas de distribución de energía comúnmente desplegados en infraestructura LATAM.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

Vulnerabilidad crítica de inyección de código en GEOVIA Geospatial Data Manager (CVSS 9.9)

Una vulnerabilidad de inyección de código afecta GEOVIA Geospatial Data Manager en las versiones 3DEXPERIENCE R2024x hasta R2026x, permitiendo a atacantes ejecutar código arbitrario en el servidor. Empresas en México y LATAM que utilizan esta plataforma para gestión de datos geoespaciales enfrentan riesgo crítico de compromiso total de infraestructura si no aplican parches inmediatamente.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-102240] A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the…

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not res…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101354] A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the fun…

A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early ab…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-102361] mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoi…

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101264] A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the…

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101263] A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing …

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101261] A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/Z…

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101262] A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown cod…

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa…

nvdcriticovulnerabilidad CVSS 9.1 NVD