Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/09/2026

[CVE-2026-54547] Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to…

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_token and pipeboard_token are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A network caller using the stre…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-45579] DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0…

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-12358] IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insuffi…

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-12666] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-12667] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-12150] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and potentially affect memory contents due to improper validation of deeply nested certificate data during …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-11934] IBM Verify Identity Access could allow an administrator to execute additional commands they are not …

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-11728] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client due to a heap buffer overflow when receiving messages from a malicious queue manager or throu…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-11926] IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insuffi…

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2025-66974] An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee …

An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91853] A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is th…

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-89026] The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf cont…

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-63443] Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29…

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's U…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2024-58385] Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php…

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91990] Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that…

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91985] Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share …

Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the share's secret credential. Attackers can exchange the disclosed hash for a link-share JWT at the share's permission level to escalate privileges and perform unauthorized writes or administrative actions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91947] FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser t…

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91941] Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrap…

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits, exhausting disk, CPU, and bandwidth on shared workers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91937] Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in Mon…

Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated attackers can submit MongoDB operator objects through the prediction API to read chat history records belonging to other users from the shared collection.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91933] Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoi…

Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from ChatFlows in other workspaces by supplying an unscoped chatflowid. Attackers can invoke GET and POST requests to retrieve tool definitions and execute tools from victim workspaces, triggering external side effects and accessing sensitive tool ou…

nvdaltovulnerabilidad CVSS 7.1 NVD