Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/09/2026

[CVE-2026-81876] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose raw-DEFLATE payload is empty or truncated. SHC…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-73456] Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampli…

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-46352] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, Suricata's IP defragmentation code could deadlock when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix. No known workarounds are available…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92716] Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGen…

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover acros…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92406] A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted ele…

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/btn_functions.php?action=add. Performing a manipulation of the argument difficulty_id results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92405] A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. Th…

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92398] A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unk…

A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the component user_list_note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92399] A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame…

A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92401] A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. Th…

A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects the function top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie. The manipulation leads to improper authentication. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-76420] A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for …

A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerability is due to incorrect initialization of encryption parameters for the AJP connector at boot time. An attacker could exploit this vulnerability by sending crafted packets to the…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-59974] Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of…

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating member paths, and the vulnerable extraction path is reachable through stanza.download and stanza.install_…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20331] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Ad…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally disc…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20234] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity …

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CV…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20305] A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remot…

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker coul…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20306] A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attack…

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit thi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20307] A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, rem…

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream.…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92625] Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. …

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service i…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92626] Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. …

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception. The exception is thrown from an asynchronous method that returns void, so it is not observed by a caller and can terminate the iDSecure pr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92397] A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerabilit…

A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-61595] djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set exclusively by the HTTP-only `TenantMiddleware`, so on the live (WebSocket/SSE) path `get_current_tenant()` was always `None` during mount and…

nvdaltovulnerabilidad CVSS 7.7 NVD