Alertas de Seguridad de la Información

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101074] A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function pa…

A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-97335] Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0…

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a c…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-86595] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-87799] Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixe…

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. T…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-90924] Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Tra…

Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-90925] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Inno…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-90926] Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecom…

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-85185] Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.1…

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full …

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-85526] Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authen…

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101072] A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system …

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Alto vulnerabilidad

28/09/2026

watchOS 27.0.1 (24R365)

Apple lanza actualización de seguridad para watchOS versión 27.0.1. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilwatchos Apple Security

M Alto vulnerabilidad

28/09/2026

[CVE-2026-86330] An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_int…

An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can p…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-82323] Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies In…

Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifiers. This issue affects Enocta Platform: through 2026-09-28.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101292] Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStrea…

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class n…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-12265] Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control…

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101066] A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLin…

A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archive Link Creation. This manipulation of the argument linkedFolder causes path traversal. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101067] A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the funct…

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component save-uploaded-file Endpoint. Such manipulation of the argument filePath/fileName leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this dis…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad alta en NeuVector permite inyección de comandos OS en contenedores privilegiados

NeuVector versiones 5.4 (anteriores a 5.4.11) y 5.5 presenta manejo inadecuado de parámetros que permite a usuarios autenticados con permisos de escritura en Políticas Runtime o acceso a claves gRPC internas inyectar comandos del sistema operativo en contenedores enforcer privilegiados. Esto resulta en compromiso total del nodo worker. Afecta principalmente a infraestructuras containerizadas en Azure, AWS y datacenters locales de la región.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad alta en Thinkware U3000 permite acceso no autorizado remoto

Se identificó una vulnerabilidad (CVSS 7.3) en Thinkware U3000 versiones hasta 1.02.04 que afecta la función PUT_FILE en el archivo /tmp/wpa_supplicant.conf del servicio TCP. Un atacante remoto puede manipular parámetros de ruta para eludir controles de acceso. La vulnerabilidad ha sido divulgada públicamente y cuenta con exploits disponibles, aumentando el riesgo inmediato para organizaciones en LATAM que usan esta plataforma en dispositivos de conectividad empresarial.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad alta en ManageEngine DDI Central permite ejecución remota de código

ManageEngine DDI Central en versiones anteriores a 6201 presenta una vulnerabilidad de escritura arbitraria de archivos (CVE-2026-12264, CVSS 8.8) explotable a través del mecanismo de sincronización de configuración en failover HA. Esta falla permite a atacantes ejecutar código remoto sin autenticación en infraestructuras de gestión DNS/DHCP altas. Empresas en LATAM que utilicen esta plataforma para administración de direccionamiento IP enfrentan riesgo inmediato de compromiso total de su red.

nvdaltovulnerabilidad CVSS 8.8 NVD