Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100663] Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not spe…

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., "CONNECT trusted.example:443") is parsed as a URI, so its host is emitted as :scheme, :path is set to "/", and the HTTP/1 Host head…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100664] Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds t…

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-94445] A malicious txtar could escape the intended execution context and force arbitrary writes to the play…

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go process to make a read for an environment configuration file rooted in the playground host's $HOME. To…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97865] A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Even…

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-85750] Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload…

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion (e.g., disguising SVG content as PNG), an attacker can trigger unintended interpretation of embedded SVG elements that reference local files. In mor…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97182] A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unkn…

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-86679] ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permission…

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-86683] ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user t…

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76980] ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to…

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-81995] Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that co…

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75686] Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitra…

Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-19480] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82008] Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could re…

Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-82003] Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could re…

Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77605] Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run …

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is the selected text-file path with .cmd appended, and the user invokes Run by system on the text file on Windows 10 or Windows 11, Notepad++ can…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

22/09/2026

Vulnerabilidad crítica en VeloCloud Orchestrator (VCO) on-prem permite acceso remoto no autorizado

VeloCloud Orchestrator (VCO) on-prem contiene una vulnerabilidad crítica (CVSS 10.0) que permite a atacantes remotos acceder a funcionalidades internas privilegiadas y comprometer la integridad del orquestador. La explotación exitosa impacta confidencialidad, integridad y disponibilidad de datos gestionados. Versiones hosted y dedicadas fueron afectadas, con implicaciones directas para proveedores de conectividad SD-WAN en México y LATAM que dependen de VCO para operaciones críticas.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-49453] Joplin is an open source note-taking and to-do application that organises notes and lists into noteb…

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher wr…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-73547] Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36…

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onCom…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-73552] Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36…

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative R…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-73513] Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36…

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ referenc…

nvdaltovulnerabilidad CVSS 7.5 NVD