Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84070] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84071] IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector p…

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection in the Universal Connector plugin upload functionality. A privileged authenticated attacker can provide a malicious filename that is incorporated into a shell command executed by the application, potentially resulting in arbitrary command execution with root-level privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84074] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-82892] IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to…

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-81669] IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create c…

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inject arbitrary shell commands through the alias input, resulting in command execution with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-81937] IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import r…

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the import remotelog_config file CLI command. A highly privileged authenticated user can inject shell commands through the filename parameter, potentially resulting in arbitrary command execution with root privileges and impact to the confidentiality, integrity, and availability of the affected system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-82887] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61820] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61821] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_config.retention_schema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partman_user access can select a target schema where the role lacks the normal CREATE privilege, and the background worker performs…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61817] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time() interpolate the writable part_config.time_dncoder text value without identifier quoting into dynamic SQL. A role with the documented partman_user privileges can store SQL rather than a decoder fu…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61818] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user access can store SQL rather than a function name, and the SQL executes with the privileges of the caller that inv…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61819] pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, …

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the lite…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-61714] FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6…

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, o…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-11727] IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause…

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-11725] IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arb…

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-11716] IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denia…

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2021-48008] Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to …

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based injection techniques to extract sensitive data from the underlying database. Exploitation evidence was firs…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2019-25776] Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers…

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the userIdentifiers GET parameter in the mobile plugin endpoint. Attackers can bypass space-based filter controls by wrapping SQL keywords in parentheses to perform UNION-based injection and extract sensitive data including admi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93752] CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() …

CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property names. Attackers can supply a stylesheet with a declaration named length to replace the internal counter and trigger excessive memory allocation during cssText serialization, causing process termination.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93759] Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instea…

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing to be evaluated by the database engine. This may result in unintended disclosure of stored field value…

nvdaltovulnerabilidad CVSS 8.6 NVD