Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85028] Creation of a temporary file in a directory with insecure permissions in the FPGA management tool in…

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own pr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85388] Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helpe…

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-82302] Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via …

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-82526] R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attacke…

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execut…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85012] Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthe…

Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with permission to commit to a repository in the project to execute arbitrary commands in the blueprint resynthesis environment via shell metacharacters in the owner field of a [local] merge strategy entry…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85187] A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affe…

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the file /rider/orders/controller.php?action=edit&actions=confirm of the component Order Status Update. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publ…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-83959] Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in…

Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-58400] GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.…

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-63219] GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.…

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files in…

nvdaltovulnerabilidad CVSS 8.6 NVD

G Medio vulnerabilidad

03/09/2026

Chromium: CVE-2026-84357 Improper input validation in Omnibox

Microsoft publica advisory de seguridad: Chromium: CVE-2026-84357 Improper input validation in Omnibox.

Microsoft MSRC

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84812] Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84848] Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.

Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84773] Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.

Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84779] Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 v…

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84763] Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in RTMKit

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84765] Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-81292] Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Simple Payment

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-81295] Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.

Unauthenticated Cross Site Scripting (XSS) in Under Construction

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-81300] Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-81773] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions…

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension

nvdaltovulnerabilidad CVSS 7.1 NVD