Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15563] A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without auth…

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15565] A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint witho…

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15567] A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2…

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15554] the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any sh…

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15555] A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicat…

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15556] A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion …

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15560] when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs …

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15561] A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and cou…

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-16053] Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to A…

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-4757] A VAPIX API parameter had improper input validation which could allow code execution and potentially…

A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-19424] Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability.…

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66763] SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated w…

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected inform…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-58243] SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality…

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44764] Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence…

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44765] Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence…

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-58230] SAP Approuter does not sufficiently validate certain token content under specific configurations. An…

SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44763] SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient …

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the i…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-8718] tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles g…

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72914] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14,…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72915] Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until …

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collectio…

nvdaltovulnerabilidad CVSS 7.5 NVD