Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/09/2026

[CVE-2026-77263] The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu…

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesse…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-86095] Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attnam…

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-86098] ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_e…

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-77393] In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which pe…

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-82684] Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization …

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-86090] ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipient…

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-86091] ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing …

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-82712] Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request for…

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85702] A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca92…

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85786] Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote atta…

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936. To remediate this issue, users should upgrade to version 1.12.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-61699] nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revoca…

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that isolates a compromised/offboarded host from a Nebula mesh. Because the blocklist never reaches any peer's config.yml, a Blocked host retains full overlay reachability to every peer under its CA (and internal services on the mesh) for up to 30d (agent) / 365d (…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85638] A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/us…

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-81939] A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and arc…

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-80114] PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics …

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded as a hardcoded literal in the distributed binary and computing valid MD5 authentication tags for arbitr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-80116] PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics …

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on device selection, register offset, or value. Attackers can obtain a device handle and issue arbitrary PCI …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-80117] PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics …

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist or port validation on exposed IOCTLs. Attackers can obtain a device handle and write to sensitive port…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-80118] PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics …

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handler writes a crash-dump-format (PAGEDU64) image of all physical memory to a caller-supplied file path in…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-80119] PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics …

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-78327] An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulner…

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to inject arbitrary commands that are executed on the underlying host, resulting in remote code execution.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-78328] A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Manage…

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

nvdcriticovulnerabilidad CVSS 9.1 NVD