Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/09/2026

Vulnerabilidad alta en Dell OpenManage Server Administrator permite ejecución remota sin autenticación

Dell OpenManage Server Administrator en versiones anteriores a 11.1.0.3 presenta una vulnerabilidad de autenticación faltante (CVSS 8.1) que permite a atacantes remotos ejecutar código sin credenciales. Esta falla afecta infraestructuras de servidores en empresas de México y LATAM que utilizan esta herramienta para gestión de sistemas Dell PowerEdge.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/09/2026

Inyección de comandos OS en Dell OpenManage Server Administrator anteriores a v11.1.0.3

Dell OpenManage Server Administrator en versiones previas a 11.1.0.3 contiene una vulnerabilidad de inyección de comandos OS (CVE-2026-81476, CVSS 8.1) que permite a atacantes remotos no autenticados ejecutar comandos arbitrarios en sistemas de administración de servidores. Esta vulnerabilidad afecta directamente infraestructuras altas en centros de datos de México y LATAM que dependen de esta herramienta para gestionar hardware Dell Enterprise.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/09/2026

Vulnerabilidad alta de desbordamiento de búfer en Dell OpenManage Server Administrator

Dell OpenManage Server Administrator versiones anteriores a 11.1.0.3 contiene una vulnerabilidad de desbordamiento de búfer en el montículo (heap) que permite a atacantes con privilegios elevados ejecutar código remoto. Esta herramienta es ampliamente utilizada en centros de datos y entornos empresariales de LATAM para gestión de servidores Dell, representando un riesgo significativo si está expuesta en redes internas o accesibles remotamente.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/09/2026

Vulnerabilidad alta en Dell OpenManage Server Administrator por clave criptográfica hardcodeada

Dell OpenManage Server Administrator en versiones anteriores a 11.1.0.3 contiene una vulnerabilidad de clave criptográfica hardcodeada (CVSS 8.1) que permite acceso no autenticado remoto. Afecta servidores físicos en centros de datos y entornos empresariales de México y Latinoamérica que utilizan esta herramienta de administración remota. Un atacante remoto podría comprometer sistemas altas de infraestructura sin requerir credenciales.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/09/2026

Vulnerabilidad alta de desbordamiento de búfer en Dell OpenManage Server Administrator

Dell OpenManage Server Administrator en versiones anteriores a 11.1.0.3 contiene una vulnerabilidad de desbordamiento de búfer en el montículo (heap-based buffer overflow) con puntuación CVSS 7.8. Un atacante con acceso local y privilegios bajos podría explotarla para elevar sus permisos en sistemas de gestión de servidores. Empresas en México y LATAM que usen esta solución para administración de infraestructura Dell requieren actualizar inmediatamente.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92903] Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-control…

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can cause Snowflake CLI to execute attacker-controlled SQL statements in the context of the victim's Snowf…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-66269] Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Contr…

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-78428] For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one …

For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-86320] A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources wit…

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/09/2026

CVE-2026-33835 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-33835 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).

windowseop Microsoft MSRC

M Alto vulnerabilidad

17/09/2026

[CVE-2026-87963] The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username reques…

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-91014] The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise an…

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-86707] The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate …

The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-86709] The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session …

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-86710] The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in…

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-87786] The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at che…

The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-88792] The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in…

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-85128] The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role reques…

The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selec…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-85130] The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a p…

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-87935] The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to…

The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated…

nvdaltovulnerabilidad CVSS 8.1 NVD