Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-76745] Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent a…

Memory corruption vulnerabilities exist in AOS-S that are reachable by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-76746] An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allo…

An unauthenticated buffer overflow vulnerability exists in AOS-S. Successful exploitation could allow an unauthenticated adjacent attacker to expose sensitive memory contents and cause a denial of service on the affected device.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106446] Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.…

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathExpression, NumberLiteral, and BooleanLiteral values. This issue bypasses the AST validation introduced in version 4.7.9 for CVE-2026-33937. An attacker who can supply an object inst…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102406] Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data…

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation process allowed a user holding delegated Fleet package-management privileges, without direct Elasticsearch …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102160] An operating system (OS) command injection vulnerability in CloudVision CUE backup management may al…

An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102161] An unauthenticated attacker located on an adjacent private network (or any attacker routed through a…

An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102162] On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at le…

On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102163] On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthe…

On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102165] On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the captu…

On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102167] On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's w…

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-101158] A missing input validation vulnerability in the Fileserver upload API allows an authenticated attack…

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102155] An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application all…

An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-102159] An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access…

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-101153] On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vul…

On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-101156] A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege adminis…

A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensit…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-101157] A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacen…

A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-82162] Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed En…

Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-83550] A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints …

A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-86360] Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Re…

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-86361] Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Criti…

Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 8.2 NVD