Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/09/2026

[CVE-2026-84499] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions o…

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum len…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-84474] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-c…

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling ho…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-77602] OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor…

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through Config…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-77394] OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor…

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76087] Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous form…

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hij…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-61814] Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work wh…

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This iss…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96759] orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanSta…

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96755] orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect gen…

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96513] A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown p…

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96514] A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the…

A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-93349] Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console…

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-88830] A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication h…

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-85724] Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are config…

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write acce…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-6668] Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthentic…

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the proc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96673] Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that all…

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-19179] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipu…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-18875] IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unau…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payme…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96275] A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary loc…

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96276] If a malicious SDK container declares an extension point with a crafted `directory` path, and a deve…

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-86679] ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permission…

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.

nvdaltovulnerabilidad CVSS 7.1 NVD