Vulnerabilidades · "Multiple Vendors" — Alertas SI

M Alto vulnerabilidad

12/10/2026

[CVE-2026-92876] IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker t…

IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

M Alto vulnerabilidad

12/10/2026

[CVE-2026-96264] IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the servic…

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to …

M Alto vulnerabilidad

12/10/2026

[CVE-2026-96265] IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service…

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploit…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-96266] IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmwa…

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-96261] IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmwa…

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availabilit…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-96262] IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service…

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to t…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-96263] IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 t…

IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation cou…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-84316] Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDire…

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directiv…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-84317] Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validatio…

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks dangerous nginx directives — js_*, perl_*, load_module of the njs/perl modules, and user root. It is enforced on three of the four config-write paths: api/config/add.go, api/config/modify.go, and mcp/config/config_modify.go. The fourth path…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-84318] Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool…

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-84319] Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configur…

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_module, js_import, and js_content. However, the MCP configuration interface allows a secondary authenticated user to write and apply equivalent restricted configuration content. This allows the user to load ngx_http_js_module.so, import atta…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-84360] Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mu…

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger r…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-75881] IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker t…

IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs.

M Alto vulnerabilidad

12/10/2026

[CVE-2026-78673] IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service du…

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation.

M Alto vulnerabilidad

12/10/2026

[CVE-2026-84313] Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and …

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside RequireSecureSession and accept a normal authenticated session without verifying the current password. An attacker with a stolen JWT can bind an attacker-controlled TOTP secret when the victim has not already enabled TOTP, or can register an a…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-84315] Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply R…

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session can therefore create or alter automatic backups, DNS credentials and records, certificates and ACME us…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-53997] Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authenticatio…

Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each…

M Alto vulnerabilidad

12/10/2026

[CVE-2026-18513] IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable t…

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.

M Alto vulnerabilidad

12/10/2026

[CVE-2026-18517] IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Appl…

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy.

M Alto vulnerabilidad

12/10/2026

[CVE-2026-18529] IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable t…

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controlled value passed to a shell command in a Kubernetes operator task.

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?