Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-16428] IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacke…

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-16432] IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote a…

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-16466] IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacke…

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to os command injection.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-15955] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an…

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90809] A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function Ex…

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. The name of the patch is af582246f141311d574551b7571a517bcc3df750. It is best practice to apply a pat…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-89023] ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vuln…

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stored offer records, delete arbitrary offers by numeric identifier, and access dashboard statistics to disclose bidder contact information, offer details, m…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-86830] Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity C…

Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center solution before version 1.5.1 might allow an authenticated remote user with application-level access to read, approve, modify, or revoke arbitrary access requests, thereby obtaining unintended temporary elevated access to the AWS accounts accessed using the TEAM deployment. This issue has b…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-82035] PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font…

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping path separators or dot-dot sequences. Attackers can supply a crafted PDF, EPUB, XPS, or FB2 file…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-59178] ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to v…

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legacy `esphome` dashboard, read the bare `$USERNAME` and `$PASSWORD` instead. When the env vars were renamed the bare names were dropped with no fallback, so…

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Medio vulnerabilidad

14/09/2026

Chromium CVE-2026-87624: UI misrepresentation in Passwords

Microsoft publica advisory de seguridad: Chromium CVE-2026-87624: UI misrepresentation in Passwords.

Microsoft MSRC

G Medio vulnerabilidad

14/09/2026

Chromium CVE-2026-87590: Improper input validation in Passwords

Microsoft publica advisory de seguridad: Chromium CVE-2026-87590: Improper input validation in Passwords.

Microsoft MSRC

G Medio vulnerabilidad

14/09/2026

Chromium CVE-2026-87583: UI misrepresentation in Passwords

Microsoft publica advisory de seguridad: Chromium CVE-2026-87583: UI misrepresentation in Passwords.

Microsoft MSRC

G Medio vulnerabilidad

14/09/2026

Chromium CVE-2026-87565: Information leak in Passwords

Microsoft publica advisory de seguridad: Chromium CVE-2026-87565: Information leak in Passwords.

Microsoft MSRC

G Medio vulnerabilidad

14/09/2026

Chromium CVE-2026-87562: Incorrect reference resolution in Accessibility

Microsoft publica advisory de seguridad: Chromium CVE-2026-87562: Incorrect reference resolution in Accessibility.

Microsoft MSRC

G Medio vulnerabilidad

14/09/2026

Chromium CVE-2026-87557: Missing authorization in LocalNetworkAccess

Microsoft publica advisory de seguridad: Chromium CVE-2026-87557: Missing authorization in LocalNetworkAccess.

Microsoft MSRC

G Medio vulnerabilidad

14/09/2026

Chromium CVE-2026-87501: UI misrepresentation in Passwords

Microsoft publica advisory de seguridad: Chromium CVE-2026-87501: UI misrepresentation in Passwords.

Microsoft MSRC

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-90945] Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be over…

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90946] DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenti…

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including Python, JavaScript, YAML, and JSON files containing hardcoded secrets and credentials.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91079] Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print serv…

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91080] webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, all…

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

nvdaltovulnerabilidad CVSS 7.5 NVD