Críticas · Vulnerabilidades — Alertas SI

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-86709] The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session …

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-86710] The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in…

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-87796] The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in …

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution poss…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-61594] djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain. As a result, standard Django authorization — `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, na…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92805] UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wiza…

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92787] Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowin…

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server.

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-76460] A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, re…

A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized ac…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-75513] Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9…

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictiona…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20332] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Ad…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally disc…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20284] A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to co…

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to an affected device. A successful exploit could allow the attacker to view or modify data on the unde…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-76423] A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remot…

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative access to an affected device. This vulnerability is due to the REST API web service being exposed with insufficient authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request to the exposed REST API port. A successful exp…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20341] A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software cou…

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software could allow an authenticated, remote attacker to obtain root privileges. This vulnerability is due to unsecured deserialization of untrusted data over the sftunnel management connection. An attacker could exploit this vulnerability by sending crafted sftunnel remote procedure calls (RPCs). A su…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20322] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Das…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20322 are related to improper access control issues that…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20324] A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Managem…

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions to write an arbitrary file to any location on the device. An attacker could exploit this vulnerabil…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20325] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Das…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20325 are related to improper neutralization of special …

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20326] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Das…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20326 are related to missing authentication for critical func…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20329] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Ad…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally disc…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20330] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Ad…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally disc…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20194] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity …

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by C…

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20211] A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary comm…

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid high-privileged administrative credentials. This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vul…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?