Alertas de Seguridad de la Información

M Crítico vulnerabilidad

08/09/2026

Vulnerabilidad crítica en hawtio-operator expone claves de firma de OpenShift

Se encontró una flaw en hawtio-operator que permite la lectura no autorizada de la clave privada de firma de la autoridad certificadora (CA) de servicios de OpenShift desde el namespace openshift-service-ca. Un atacante con permisos de creación de recursos Hawtio en cualquier namespace puede falsificar certificados de cliente con CN arbitrario, escalando privilegios en clústeres OpenShift. Esta vulnerabilidad afecta directamente a empresas en LATAM que ejecutan plataformas de contenedores en OpenShift.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

Inyección de comandos OS crítica en Cosminexus Component Container (CVE-2026-71376)

Una vulnerabilidad de inyección de comandos del sistema operativo (CVSS 9.8) afecta múltiples versiones de Cosminexus Component Container, permitiendo a atacantes ejecutar comandos arbitrarios con privilegios de la aplicación. La falla impacta versiones desde 11-70-01 hasta 09-80 y anteriores. Empresas en LATAM que usan este middleware de aplicaciones para sistemas críticos deben aplicar parches inmediatamente.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

Vulnerabilidad crítica de inyección de argumentos en Cosminexus Component Container (CVE-2026-71377)

Se ha identificado una vulnerabilidad de inyección de comandos en Cosminexus Component Container con puntuación CVSS 9.8, afectando múltiples versiones desde la 11-70-01 hasta la 09-80. Esta vulnerabilidad permite a atacantes ejecutar comandos arbitrarios en servidores afectados, comprometiendo la integridad y disponibilidad de aplicaciones empresariales críticas. En Latinoamérica, las organizaciones financieras, de telecomunicaciones y sector público que utilizan este componente enfrentan riesgo inmediato de exfiltración de datos y acceso no autorizado.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-62645] A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed …

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-50093] A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), S…

A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this …

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-71374] Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affec…

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 0…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

CVE-2026-68785 Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68785 Microsoft SQL Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

sql-serverrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

CVE-2026-68833 Windows NTFS Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68833 Windows NTFS Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

CVE-2026-71329 Windows NTFS Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-71329 Windows NTFS Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

CVE-2026-71350 Windows Spaceport.sys Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-71350 Windows Spaceport.sys Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

CVE-2026-71348 Windows Spaceport.sys Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-71348 Windows Spaceport.sys Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

CVE-2026-77887 Windows DHCP Server Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-77887 Windows DHCP Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

CVE-2026-77891 Windows DHCP Server Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-77891 Windows DHCP Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-86510] A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params …

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-76969] @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multit…

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. …

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-86509] A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of t…

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-66768] SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked fro…

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and avai…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-58240] SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application…

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confide…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-44756] A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Und…

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availabil…

nvdcriticovulnerabilidad CVSS 10.0 NVD

F Crítico vulnerabilidad

08/09/2026

JWT used for authentication in web GUI signed with static key

Fortinet PSIRT publica advisory de seguridad: JWT used for authentication in web GUI signed with static key. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortimonitor.

firewall PAN PSIRT