Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95831] Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Pyth…

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly. The impact is that arbitrary code can be inv…

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95861] A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability f…

A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95862] A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability foun…

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94462] Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5…

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible …

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83963] Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbit…

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-84395] Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in …

Premiere Pro is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation potentially resulting in unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-81998] Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbit…

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-81999] Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability…

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82000] Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability…

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83962] Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result i…

Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-79906] Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbit…

Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-81995] Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that co…

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77544] A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability foun…

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77555] A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability foun…

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77556] A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found…

A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77558] A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found…

A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77259] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advis…

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77262] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled file_path and does not apply the path restriction added for the earlier download vulnerability. A caller can traverse outside the workspace and upload arbitrary server-readable files to Confluence. The advisory traces the …

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77248] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachment accepts an unrestricted file_path. An unauthenticated network caller can read files available to the MCP process, upload them to an attacker-select…

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77253] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the client-to-server filesystem boundary and disclose configuration, credentials, mounted secrets, or …

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?