Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109521] A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca25…

A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109522] A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca…

A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the argument cid/did leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109523] A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d3…

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipulation of the argument city/cid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be use…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-108184] Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated use…

Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-108185] Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthe…

Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

13/10/2026

[CVE-2026-104192] Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueOb…

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the shared object when a duplicate consumer entry is rejected. Cleanup subsequently frees the same object again. In the default configuration, where Dra…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-93907] IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication…

IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-95680] IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass author…

IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

13/10/2026

[CVE-2026-74043] Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_r…

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-74045] Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_l…

Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-74034] Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrol…

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-74035] Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where securit…

Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-74036] Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust…

Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-74037] Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles,…

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

13/10/2026

[CVE-2026-74040] Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterH…

Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a trailing-slash basename bypass and missing extra_valid enforcement to overwrite ossec.conf and agent.conf, achieving root remote code execution across the manager …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/10/2026

[CVE-2026-74041] Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and…

Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109965] Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to acce…

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlinks, so file tools like read_file and create_text_file can read or overwrite files such as SSH keys or cloud credentials.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109967] yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats…

yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109960] Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authent…

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

13/10/2026

[CVE-2026-109961] Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated cu…

Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries …

nvdaltovulnerabilidad CVSS 8.5 NVD