Alertas de Seguridad de la Información

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-83660] Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that …

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-84412] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82008] Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could re…

Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82009] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction. Scope is …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82010] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82011] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Sco…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82013] Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that …

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82443] Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that …

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-77244] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's globally configured Jira or Confluence credentials. A network client that can reach the MCP endpoint can invoke Atlassian tools as the operator, inc…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75721] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75723] Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu…

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75728] Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu…

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-73369] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75699] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75703] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-43641] Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerabil…

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-94456] Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically…

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exp…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-85734] LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login en…

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authentic…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-86059] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organizatio…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider rows without applying getAccessibleGitProviderIds or an organization check. The application.one route…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80156] Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips ba…

nvdcriticovulnerabilidad CVSS 9.1 NVD