Alertas de Seguridad de la Información

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46929] Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Plan…

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Bas…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46916] Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business S…

Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. Successful attacks of this vulnerability…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46921] Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel C…

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applicati…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46903] Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Busines…

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-48780] Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously craft…

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email ad…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45567] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-44810] Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate…

Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-41720] Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a …

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11618] A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function pr…

A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file taier-data-develop/src/main/java/com/dtstack/taier/develop/interceptor/LoginInterceptor.java of the component Source Connection Test Endpoint. Executing a manipulation can lead to improper authentication. The attack may be performed from remote. The exploit has been publicly disc…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49194] The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prom…

The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49202] Internal multimedia session archives are accessible without authentication, exacerbated by loose Cro…

Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49203] Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, …

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10777] A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b8…

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product …

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

02/06/2026

[CVE-2026-49443] authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, …

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10619] A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93…

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or update…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10617] A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the…

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-8293] The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor chal…

The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.

nvdaltovulnerabilidad CVSS 7.5 NVD