Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85439] MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::…

MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85440] MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommP…

MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulnerability in MOOSCommPkt packet handling that allows remote attackers to write arbitrary data by declaring a negative packet length. Attackers can exploit the signed integer check in InflateTo() and negative size conversion in recv() to overflow a four-byte heap buffer during the HandShake phase before authentication.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85441] MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in C…

MOOS core-moos through 10.4.0 fails to validate that serialized string lengths are non-negative in CMOOSMsg::operator>>. Unauthenticated attackers can send a crafted message with a negative length value to the MOOSDB port, causing an unhandled exception that terminates the database process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85442] MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesW…

MOOS core-moos through 10.4.0 fails to validate packet length declarations in CMOOSCommPkt::OnBytesWritten(), allowing unauthenticated attackers to trigger unbounded buffer allocation by sending crafted wire packets. Attackers can send packets with large declared lengths to exhaust server memory and cause denial of service before client authentication completes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85430] MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that ac…

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85431] MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerab…

MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection vulnerability in pMOOSBridge when configured with UDPListen. Attackers can send crafted UDP packets to the configured port to inject arbitrary variables into the local MOOS community with spoofed source and community identifiers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85432] MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowi…

MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source a…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85433] MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing …

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85434] MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbo…

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85435] MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on th…

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85436] MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPkt…

MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85424] MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated cl…

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85425] MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable…

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85426] MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names w…

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85427] MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allow…

MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85428] MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB…

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85429] MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather t…

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-70178] Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a…

Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-70352] Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to…

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-80098] Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker t…

Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD